The 24-hour test: CRA incident readiness for manufacturers selling into the EU
Reporting duties under the Cyber Resilience Act began on 11 September 2026. The hard part is not the form. It is knowing, within hours, what happened and who decides.
- Author
- Ahmed Furkan Gul
- Published
- 2026-10-23
- Pages
- 4
- Available languages
- English
Reporting duties under the Cyber Resilience Act began on 11 September 2026. The hard part is not the form. It is knowing, within hours, what happened and who decides.
Editorially structured from the original publication.The report in brief.
Since 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents affecting the security of their products: an early warning within 24 hours and a notification within 72 hours, followed by a final report. The duty sits with the manufacturer. Many Turkish manufacturers of connected devices, industrial equipment and commercial software have invested in IT security, but have no named owner and no rehearsed path for a product incident. Readiness is demonstrated in an exercise, not in a policy document: a named owner, product and version facts that can be assembled quickly, a clear decision rule, and draft text that can go out on time.
What the source supports.
- 01
Reporting has started
Since 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents affecting the security of their products: an early warning within 24 hours and a notification within 72 hours, followed by a final report.
- 02
The duty stays with the manufacturer
The duty sits with the manufacturer. Many Turkish manufacturers of connected devices, industrial equipment and commercial software have invested in IT security, but have no named owner and no rehearsed path for a product incident.
- 03
Readiness is proven in an exercise
Readiness is demonstrated in an exercise, not in a policy document: a named owner, product and version facts that can be assembled quickly, a clear decision rule, and draft text that can go out on time.
Sources and methodology+
- Original document
- The 24-hour test: CRA incident readiness for manufacturers selling into the EU, v1
- Data period
- October 2026
- Methodology
- Desk review of official EU and Turkish sources checked on 21–23 October 2026, combined with Ganrich Advisory’s October 2026 review of opportunities in Türkiye.
- Limitations
- General information, not legal, customs, tax or engineering advice. Rules and dates change; confirm against official sources. No client work or results are described.
- Last editorial review
- 2026-10-23
Read the original report
Explore the complete publication, including its original charts, sources, and methodology.
The reader loads only when requested so the editorial page remains fast.