Since 11 September 2026, anyone distributing software in the European Union has to report, within 24 hours, a vulnerability in their product that someone is exploiting. It is the first part of the Cyber Resilience Act, Regulation (EU) 2024/2847, to apply; the rest applies from 11 December 2027.
The obligation also covers programs you can download for free, as long as there is a commercial activity behind them. That includes us: Effetto, our promissory note software, is free, and under the regulation M's Works is its manufacturer.
What must be reported and how fast
Article 14 covers two situations: actively exploited vulnerabilities, meaning there is reliable evidence that someone has used them, and severe incidents affecting the security of the product. A flaw found during testing, with no sign of exploitation, gets fixed and does not get notified.
For an exploited vulnerability, the deadlines run like this:
24 hours
for the early warning, from when the manufacturer becomes aware
72 hours
for the notification with details on the product and the flaw
14 days
for the final report, from when the fix is available
For a severe incident the first two are the same, and the final report is due within one month of the notification. The same article requires informing the affected users and telling them what they can do to limit the damage.
Who receives the report in Italy
You notify once, on ENISA's Single Reporting Platform. From there the notification goes to the coordinating CSIRT of the country where the manufacturer has its main establishment and, save in exceptional cases, to ENISA at the same time. For Italy the coordinator is CSIRT Italia, part of the National Cybersecurity Agency.
Before sending anything the company has to register its contact people, whom ENISA calls Assigned Representatives and for whom it has published a guide. Do it now and test the login: the early warning goes out from that platform, and registering while the 24 hours are running is time taken away from checking the flaw.
Free does not mean outside the CRA
Article 3 defines making available on the market as a supply "whether in return for payment or free of charge", provided it happens in the course of a commercial activity. Recital 15 explains when that is the case: besides a price for the product, it is enough to charge for technical support beyond covering costs, to intend to make money through the software (with a platform used to sell other services, for example), or to require personal data for purposes other than the security and compatibility of the program.
Free and open-source software that nobody monetises is left out (recital 18), and so are websites that do not support the functionality of a product and cloud services, which fall under the NIS2 directive (recital 12). For borderline cases there is the Commission's guidance, on the Cyber Resilience Act page.
Since September Effetto can be downloaded for free, with no key and no limits, but the code is closed and what we sell are the services around it: assisted setup, importing existing archives, training. Free program, paid support: that is the second sign in recital 15. Our reading is that M's Works is the manufacturer of Effetto and that the obligation has applied to us since 11 September, including copies downloaded before then: Article 69 applies Article 14 to every product placed on the market before December 2027.
What we did for Effetto
The 24 hours start when we find out, so the first thing we needed was an address people could write to. We published a security.txt, the standard file (RFC 9116) a website uses to say who to contact about a security problem. It points to security@msworks.it, the same address that appears in Effetto's licence. The file has an expiry date, ours is 1 October 2027, and it has to be renewed before then: an expired security.txt is treated as invalid.
Then there is the route a fix takes to reach the people using the program. When a new version comes out, Effetto says so, but the user decides when to install it. With an exploited flaw, the notice to users that Article 14 asks for is what actually gets the fix installed.
If the flaw is in a library we use, Article 13 requires us to report it to whoever maintains it as well. The rest arrives in December 2027: a declared support period, as a rule at least five years, the technical documentation and the CE marking.
Being a microenterprise does not exempt us. Article 64 only spares micro and small enterprises the fines for an early warning sent after the 24 hours. For the 72-hour notification they apply as they do to everyone.
If a supplier built your software
For the CRA, a manufacturer is also anyone who has a product designed or developed and puts it on the market under their own name or trademark (Article 3). If an agency built an app or a program that you distribute to your customers with your logo, the reporting is on you.
So before signing, ask the supplier for the list of components and a commitment to warn you when one of them has a flaw, and have them explain how a fix would reach the people using the product.
What to prepare now
- List the programs, apps and devices you distribute under your name, free ones included.
- For each one, list the libraries, frameworks and external services. Without that list you cannot tell whether a newly published flaw affects you.
- Publish an address for reports and a security.txt pointing to it, and decide who reads that inbox.
- Write down who decides whether a report concerns an exploited vulnerability and who sends the early warning, with a stand-in for holidays.
The dates and the penalties
The timetable is in Article 71. The rules on conformity assessment bodies have applied since 11 June 2026, the reporting obligations since 11 September. Everything else arrives on 11 December 2027, including the security requirements, the CE marking and the penalties in Article 64: up to 15 million euros or 2.5% of worldwide annual turnover, whichever is higher, for failing to meet the essential requirements and the obligations of Articles 13 and 14.
If you distribute a program or an app under your name, write to us. We start with a security audit of the product and its components and tell you what is missing to be ready for the 24 hours.