CRA report form
The Cyber Resilience Act (CRA) places greater responsibility for the digital security of products on manufacturers, importers and distributors. From Friday 11 September 2026, the first key obligation will come into force: manufacturers must actively report exploited vulnerabilities and serious security incidents in their digital products to the National Cyber Security Centre. You can submit a CRA report using the form below.
Who is this form for?
The Cyber Resilience Act requires manufacturers of digital products to report any actively exploited vulnerability or serious incident in their products to the NCSC. This applies to manufacturers whose EU head office is in the Netherlands and covers all products with digital elements that are available on the European market on 11 September 2026. Not sure? Read more in the Cyber Resilience Act Guide published by the regulator, the Dutch Authority for Digital Infrastructure. Would you like to report something else? Go to ‘Contact and Report’.
Reporting via MijnNCSC offers advantages
It is best to report an incident via MijnNCSC, as this allows you to monitor any follow-up reports in one place. If you are not (yet) registered on MijnNCSC, the form below is a secure alternative.
What happens to your report?
After submitting your report, you will receive an email with an acknowledgement of receipt and a reference number. The NCSC ensures that your report is forwarded to the European cyber security agency ENISA and to the CSIRTs of the other Member States where your product is available. This means you do not need to report to two different organisations. The report details are also accessible to the Dutch regulator, the Dutch Authority for Digital Infrastructure.
What information do you provide and when?
The CRA operates a phased reporting system with strict deadlines. The initial phases begin from the moment you become aware of the vulnerability or incident.
- Phase 1: Early warning
Deadline: within 24 hours
Information to be provided: Report of the vulnerability or incident, indicating in which EU Member States the product is available. - Phase 2: Report
Deadline: within 72 hours
Submission: General information about the product, the nature of the vulnerability or incident, and the mitigating measures taken and recommended. - Phase 3: Final report (vulnerability)
Deadline: no later than 14 days after a patch or mitigating measure becomes available
Submission: Full description, including severity, any information about the attacker, and details of the mitigating measure made available.
Phase 3: Final report (incident)
Deadline: Within 1 month of the 72-hour notification
Submission: Full description of the incident and the measures taken.
Loading results...