Copla CEO says CRA reporting duties already run year-round
Original title: The Cyber Resilience Act clock doesn’t stop for weekends
He says early warnings must go out within 24 hours, including holidays, under fines of €15 million or 2.5% of turnover.
In a Help Net Security interview, Copla CEO Aurimas Bakas describes EU Cyber Resilience Act reporting duties for manufacturers. He says Article 14 covers products already on the market, so old firmware still in use counts, and boards focus on December 2027 CE marking while reporting began on 11 September 2026. He urges a version register, a written definition of awareness, named on-call filers, supplier contract deadlines, and a weekend tabletop through a signed early-warning draft.
Unconfirmed: The account is one executive’s experience and advice, not a regulator ruling or confirmed enforcement case.
- Reporting has no end date and uses the same fine ceiling as the rest of the regulation.
- ENISA’s platform allows one primary representative and up to 20 secondary ones.
- Filing at launch is a web form behind EU Login with multi-factor authentication.
- Bakas says CRA support expectations are at least five years for most products.
- He advises supplier notice times shorter than the supplier’s own 24-hour authority warning.
- Organizations
- CoplaENISAEuropean Union
From the original article
5 min read at helpnetsecurity.com
In this Help Net Security interview, Aurimas Bakas, CEO of Copla, talks about what the EU Cyber Resilience Act‘s reporting duties mean for manufacturers. He explains why companies need a register of every product version still in use, why boards focus on CE marking while reporting obligations started in September 2026, and how to define the moment a company becomes aware of an exploited flaw.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.