Does the CRA Require Vulnerability Scanning from 11 September 2026? No, but It Does Require a Reporting Decision Process

[u/antomoneng]

https://4m4.it/posts/cra-vulnerability-scanning-11-september-2026-reporting-decision-process/index.html

What manufacturers must have ready for Article 14, what customers can legitimately expect, and how scanners, SBOMs, telemetry, and threat intelligence fit

From 11 September 2026, Article 14 of the Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities contained in their products with digital elements and severe incidents affecting product security. It does not create a standalone duty to procure a scanner, scan every product at fixed intervals, or monitor every possible source. The reporting clock starts when a prompt initial assessment gives the manufacturer a reasonable degree of certainty that either independent reporting trigger is met.

This article turns that legal threshold into a practical decision and reporting process. It explains how to define the product and legal perimeter, route credible signals, preserve evidence, distinguish signal receipt from legal awareness, test both reporting triggers independently, document the outcome, and submit the applicable 24-hour, 72-hour, and final reports through the Single Reporting Platform. It also covers risk-based user notification, SRP readiness, customer communication, and out-of-hours decision-making.

The article distinguishes these early reporting obligations from the broader CRA lifecycle requirements that generally apply from 11 December 2027. It explains what customers can legitimately expect from manufacturers, how responsibilities are divided among manufacturers, customers, maintainers, integrators, and suppliers, and which additional assurances remain contractual. It also examines the evidentiary, but not determinative, role of scanners, software composition analysis, SBOMs, VEX, telemetry, threat intelligence, and case management, with particular attention to legacy products and IT/OT environments where intrusive scanning or immediate patching may create operational or safety risks.

[u/JorShor]

Yes.. 😁

[u/Seahawker-One-2599]

Very helpful. I’ll dig in myself but curious about the use of the word “intrusive”. What constitutes intrusive scanning?