Skip to main content

Health-ISAC Hacking Healthcare 9-29-2026

Hacking Healthcare logo featuring a computer mouse, hacker hat icon, and medical cross.

This week, Health-ISAC®‘s Hacking Healthcare® checks back on legal and regulatory developments in the European Union (EU). In particular, we examine where we are in the rollout of the Cyber Resilience Act (CRA), including the newly implemented reporting obligations.

 

PDF Version:

 

Text Version:

Welcome back to Hacking Healthcare® !

Cyber Resilience Act Reporting Obligations Begin 

The CRA is part of the EU’s broader push in recent years to improve cybersecurity, privacy, and resiliency. It builds on strategic priorities and issue areas highlighted in strategy documents like the 2020 EU Cybersecurity Strategy for the Digital Decade[i] and the EU Security Union Strategy[ii], while complementing existing regulations and directives like NIS2[iii] and the medical device regulations.[iv] While it entered into force in mid-December 2024, the CRA is still progressing toward full application in December of next year and just hit a milestone worth examining in more depth.

What Are the Reporting Obligations?

It has been some time since we last checked in with the CRA, and while guidance documents and implementing acts have come out in the meantime, the first major operational implementation milestone is the beginning of reporting obligations for entities classified as manufacturers.[v]

As of September 11, entities classified as manufacturers under the CRA are required to report actively exploited vulnerabilities and severe incidents impacting the security of products with digital elements. These reporting obligations include:[vi]

  • Early warning reporting: Without undue delay and in any case within 24 hours of becoming aware of the actively exploited vulnerability or severe incident.
  • Actively Exploited Vulnerability/Severe Incident Notification: Without undue delay and in any case within 72 hours of becoming aware, providing general information and an initial assessment.
  • Final Reporting: No later than 14 days after a corrective or mitigating measure (e.g., patch) becomes available for actively exploited vulnerabilities and within 1 month after the 72-hour notification for severe incidents.

Reporting Process, Streamlining, and Exceptions 

To facilitate and simplify the new reporting, the CRA directed the European Union Agency for Cybersecurity (ENISA) to develop and manage a new single reporting platform (SRP). Notably, the SRP streamlines reporting so manufacturers need only report once through the portal rather than notifying each national authority separately. In general, reporting published through the SRP will be simultaneously sent to the Computer Security Incident Response Team (CSIRT) where the manufacturer is based and to ENISA. The CSIRT will then share the reported information with all other relevant CSIRTs.

However, there are exceptional circumstances that will allow a CSIRT to delay broader notification. This may occur in situations meeting two requirements:[vii]

  1. In situations where “the cybersecurity risks posed by the dissemination outweigh its security benefits and those risks cannot be mitigated by placing restrictions on the handling or further sharing of the notification through appropriate protocols…”; and
  2. One of at least four further conditions is met, which include the near completion of an effective risk mitigation measure or the potential of the reported information to inform the creation of an exploitation technique.

The full explanation of these exceptional circumstances is in a Delegated Act from December of 2025.[viii]

ENISA publicly announced the SRP’s launch on September 11, the same day reporting obligations began. While technically operational as required, ENISA has said it plans to “continue to improve and expand its functionalities over the coming months based on operational experience and user needs.”[ix]

What’s Next?

With just over a year left before full implementation is expected, there are still a number of developments left to be completed. The European Commission has updated a webpage on CRA implementation which members can use to follow developments and assess upcoming due dates.[x] The next major milestone is expected to be the “Delegated Act specifying the presumption of conformity for the European Union Cybersecurity Certification scheme on Common Criteria (EUCC) with the CRA” sometime in Q4 of this year.

Action & Analysis
**Included with Health-ISAC Membership**

[i] https://digital-strategy.ec.europa.eu/en/library/eus-cybersecurity-strategy-digital-decade-0

[ii] https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020DC0605&from=EN

[iii] https://digital-strategy.ec.europa.eu/en/policies/nis2-directive

[iv] https://eur-lex.europa.eu/eli/reg/2017/745/oj/eng & https://eur-lex.europa.eu/eli/reg/2017/746/oj/eng

[v] The CRA defines a Manufacturer as a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetization or free of charge. Please see the full CRA text and additional guidance for further clarification of who may be classed as a manufacturer.

[vi] https://www.enisa.europa.eu/sites/default/files/2026-07/ENISA_CRA_SRP_Factsheet_v1.0_0.pdf

[vii] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026R0881

[viii] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026R0881

[ix] https://www.enisa.europa.eu/news/the-cra-single-reporting-platform-is-launched

[x] https://digital-strategy.ec.europa.eu/en/factpages/cyber-resilience-act-implementation

OpenAI pledges $1B to provide resources, training for frontline cyber defenders
Healthcare Cybersecurity is Entering the Era of Collective Defense