# EU Cyber Resilience Act: Vulnerability Reporting Obligations

DevFeed: [EU Cyber Resilience Act: Vulnerability Reporting Obligations](<https://devfeed.tech/articles/eu-cyber-resilience-act-vulnerability-reporting-obligations-13794.md>)

Original publisher: [Read original article](<https://developer.espressif.com/blog/2026/09/esp32-cra-obligations-and-deadlines/>)

Author: John Lee

Published: 2026-09-09T00:00:00Z

Content type: article

Language: en

Sources: [Blog on Developer Portal](<https://devfeed.tech/sources/blog-on-developer-portal.md>)

Topics: [cyber resilience act](<https://devfeed.tech/topics/cyber-resilience-act.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Espressif](<https://devfeed.tech/topics/espressif.md>), [ESP32](<https://devfeed.tech/topics/esp32.md>), [ESP-IDF](<https://devfeed.tech/topics/esp-idf.md>), [Security](<https://devfeed.tech/topics/security.md>), [EN 18031](<https://devfeed.tech/topics/en-18031.md>)

Tags: [blog](<https://devfeed.tech/tags/blog.md>), [cyber-resilience-act](<https://devfeed.tech/tags/cyber-resilience-act.md>), [en-18031](<https://devfeed.tech/tags/en-18031.md>), [esp-idf](<https://devfeed.tech/tags/esp-idf.md>), [esp32](<https://devfeed.tech/tags/esp32.md>), [espressif](<https://devfeed.tech/tags/espressif.md>), [eu](<https://devfeed.tech/tags/eu.md>), [iot](<https://devfeed.tech/tags/iot.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This article explains that the Cyber Resilience Act's vulnerability-reporting obligations begin on 11 September 2026 for connected products sold in the EU, including products already on the market. It outlines Article 14 duties, reporting recipients and the role of Espressif's platform layer for products built on ESP32.

## Source excerpt

The CRA's vulnerability reporting obligations start on 11 September 2026 and apply to products already on the market, including ones sold years ago. What Article 14 requires, which duties run to whom, how reporting works through the ENISA Single Reporting Platform, and where the Espressif platform layer fits.