Summary

  • Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security. The first warning is due within 24 hours; the full notification within 72.
  • Mandalari’s RIPE 93 proposal was practical: feed real network-appliance, software-distribution and support-lifetime cases into CRA standards work while the drafts are still open for review.

The Cyber Resilience Act has given manufacturers a 24-hour reporting clock. It has not given every network operator the same legal job. That boundary was the useful part of Anna Maria Mandalari’s intervention at RIPE 93: before a security incident lands in an inbox, an organisation needs to know which products it places on the European market, what role it plays in each supply chain and who can send the report.

RIPE’s transcript identifies Mandalari as the remote presenter for the session’s final talk. She connected the Act to familiar network gear—routers, modems and switches—and to software used in network operations. Her central request was that the RIPE community contribute concrete operating cases to the standards discussion: how long equipment stays deployed, who provides updates, and where manufacturers, distributors and customers hand responsibility to one another.

The dates make the request urgent. The main CRA provisions apply from 11 December 2027, but Article 14 reporting has applied since 11 September 2026. A manufacturer that becomes aware of an actively exploited vulnerability or a severe incident affecting a product’s security must send an early warning within 24 hours and a fuller notification within 72 hours. The final report is due no later than 14 days after a corrective measure is available for an actively exploited vulnerability, or within a month of the 72-hour notification for a severe incident. Reports go through the CRA Single Reporting Platform.

That duty falls on manufacturers, not automatically on every company that runs a network or buys a router. The European Commission’s July guidance addresses product scope and substantial modification. Its CRA summary defines a manufacturer around a person or company that develops or manufactures a product, or has it made, then places it on the EU market under its name or trademark. A network operator that buys an unmodified device is not made its manufacturer by the purchase alone. Selling a product under its own brand or substantially changing it can alter the analysis; the actual product and distribution arrangement matter.

This is where standards and operations meet. ETSI said on 13 August that 17 vertical final-draft standards supporting the CRA were under public enquiry. They are intended to become harmonised standards; they were still drafts, not final rules. Depending on the product area, the approval process was scheduled to run from mid-September into mid-November 2026. Mandalari urged RIPE participants to bring examples about support periods, network appliances, software distribution and update handling into that work.

Her concern was not just whether a vendor promises updates. Operators need to understand how a security update is tested, audited, deployed and assessed for impact. The CRA requires manufacturers to set and disclose a product support period, but a network’s equipment may remain in service on a different timetable. A support promise that ends before a planned refresh can turn a procurement decision into an emergency migration.

Mandalari’s institutional position gives that request reach across research, operations and standardisation. UCL lists her as Deputy Director of its Institute of Communications and Connected Systems; ETSI lists her as Secretary of the CYBER EUSR working group and Chair of RIPE’s IoT Working Group. She was asking the network community to make the standards process answer a network question: who owns the next update, and who owns the first report when the product fails?

The Commission has published implementation guidance, and the reporting platform is operating. The remaining work is not to invent another deadline. It is to connect product identity, supplier role, support lifetime and incident authority before a real vulnerability forces those facts into a 24-hour scramble.

Sources