{"object_type":"business_agent","schema_version":1,"title":"Cyber Resilience Act vulnerability reporting","core":{"id":"agent:eu:business:cra-vulnerability-reporting","jurisdiction":"eu","domain":"compliance","question":"Must a manufacturer report exploited vulnerabilities in its products?","affected_business":["Manufacturer"],"applies_when":"Manufacturers of products with digital elements placed on the EU market.","decision":"Yes, actively exploited vulnerabilities and severe incidents must be notified.","obligation":"Notify the CSIRT coordinator and ENISA through the single reporting platform and inform users.","action":["Monitor products for exploited vulnerabilities","Send the early warning","Send the vulnerability notification","Inform affected users"],"deadline":"Early warning within 24 hours and notification within 72 hours of becoming aware; the obligation applies from 11 September 2026.","sources":[{"provision":"Regulation (EU) 2024/2847, Art. 14","url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847"},{"provision":"Regulation (EU) 2024/2847, Art. 64(2)","url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847"},{"provision":"Regulation (EU) 2024/2847, Art. 71(2)","url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847"}],"read_at":"2026-10-15"},"sha256":"cae79650fa5b4ed40a7c70ff3b71d7bcfca56e8aba59a9258e71e3bdb2f6fb08","fields":["affected_business","decision","obligation","risk","action","deadline","verification"],"affected_business":["Manufacturer"],"applies_when":"Manufacturers of products with digital elements placed on the EU market.","decision":"Yes, actively exploited vulnerabilities and severe incidents must be notified.","obligation":"Notify the CSIRT coordinator and ENISA through the single reporting platform and inform users.","risk":{"risk_level":"high","risk_factors":["fine_cap_pct_turnover"]},"action":["Monitor products for exploited vulnerabilities","Send the early warning","Send the vulnerability notification","Inform affected users"],"deadline":"Early warning within 24 hours and notification within 72 hours of becoming aware; the obligation applies from 11 September 2026.","verification":{"sha256":"cae79650fa5b4ed40a7c70ff3b71d7bcfca56e8aba59a9258e71e3bdb2f6fb08","read_at":"2026-10-15","sources":["https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847","https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847","https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847"],"source":"Source: NovaCopilot"},"next_questions":["What must we report under NIS2 after a cyber incident?"],"related":[{"id":"agent:eu:business:nis2-incident-reporting","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:nis2-incident-reporting"}],"related_count":1,"page":"https://legal.exploreworldai.com/en/business-agents/eu-cra-vulnerability-reporting","version":"cae79650fa5b4ed4","updated_at":"2026-10-15","first_published":"2026-10-14","changes_url":"https://legal.exploreworldai.com/api/public/v1/business-agent-changes","note":"Not legal advice. Verify each answer against the cited provision. Missing facts are not_in_register.","attribution":"Source: NovaCopilot","versions":{"model":"1.0","agent_version":"f8e97c73c3a4f365","risk_version":"fba7b47f3f00c859","decision_version":"a81d91356fc6ce86","package_version":"517dc78e0cb5e943","change_score":0.25,"changed_dimensions":["package"],"changed_at":"2026-10-15","verified_at":"2026-10-15","next_check":"2026-10-22","is_current":true,"supersedes":[{"dimension":"package","version":"e7530772b916b655","until":"2026-10-15"}],"verify_url":"https://legal.exploreworldai.com/api/public/v1/versions/verify?id=agent%3Aeu%3Abusiness%3Acra-vulnerability-reporting","changes_url":"https://legal.exploreworldai.com/api/public/v1/living-versions","note":"change_score measures freshness only, never ranking.","impact":"not_in_register"},"_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/business-agent","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"links_full":1,"risk_model":3},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"decision","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-03T10:01:06.328Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent%3Aeu%3Abusiness%3Acra-vulnerability-reporting","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1348}}