If you are outside the EU, this still applies

The Cyber Resilience Act applies to products placed on the EU market, not to companies established in the EU. An Israeli, American or British vendor selling into Europe carries the same reporting duty as a German one.Art. 2⁠(1)⁠

Which authority receives your report

You report to the CSIRT designated as coordinator in the member state where you have your most significant connection, and to ENISA, through the single reporting platform.Art. 14⁠(7)⁠ The connection is decided in order:

1
Your authorised representative
If you have appointed one, their member state decides.
2
Your importer
Failing a representative, the member state where your importer is established.
3
Your distributor
Failing an importer, where your distributor or reseller is established.
4
Your users
Failing all of those, the member state where the largest number of your users are.

In practice this means a vendor with no EU entity but a German distributor reports to Germany, and one selling only direct to customers reports wherever most of those customers are. It is worth settling this before you need it: working it out under a 24-hour clock is not the moment.

The 27 coordinators

Work out yours in five questions

Run the scope check

Also on this

Article 14
What Article 14 of the Cyber Resilience Act requires: who reports, when the 24-hour, 72-hour and final clocks start, and which authority receives each filing.
Filing on the platform
Every field the ENISA platform asks for at each of the three stages, who may submit, what its validation does not gate, and what its own counter gets wrong.
Deadlines
Every date that matters in the Cyber Resilience Act, from entry into force to the reporting duty on 11 September 2026 and full obligations on 11 December 2027.
Where to report
The coordinating CSIRT in all 27 member states, the Article 14(7) rule for working out which one is yours, and why choosing wrong can void a notification.
Fines
Up to €15 million or 2.5% of turnover for the reporting duty, and what the other two bands cover. What the authority weighs, and where small companies stand.
Readiness
The Article 13 duties as a questionnaire, which eight of them block a filing, and the five documents a manufacturer needs by December 2027.
Monthly digest
One email a month: how many vulnerabilities the CISA exploited catalogue added, and how many sit in components that appear in real inventories. Counts only.
Product classes
Every important and critical product category in the Cyber Resilience Act, what each class means for conformity assessment, and why none changes a deadline.
Document outlines
The vulnerability handling process, disclosure policy, SBOM policy, Annex VII documentation and Annex V declaration, as outlines citing the article for each.

This produces evidence, timelines and drafts. It is not legal advice, and you remain the party responsible for reporting.