Finite State Customers Are Ready for CRA's September 11 Reporting Deadline

When the EU Cyber Resilience Act's first reporting obligations take effect on September 11, 2026, manufacturers working with Finite State can establish within minutes whether an actively exploited vulnerability is present and reachable in a product they shipped.

COLUMBUS, Ohio--(BUSINESS WIRE)--Finite State, a leader in product security and software supply-chain risk management, today announced that connected device manufacturers using its platform are ready for the EU Cyber Resilience Act's September 11 reporting obligations. These manufacturers will enter the deadline able to answer the notification's hardest question: whether an actively exploited vulnerability is present and reachable in the build they shipped.

The clock starts when a manufacturer determines its product is affected and someone’s exploiting the flaw—a judgment call made under time pressure, requiring an accurate picture of what’s inside the product and whether the vulnerable code can run there.
Share

The rule reaches ordinary connected equipment—a home router or a controller on a factory line—and it covers products still under support that shipped long before anyone was planning for the regulation.

From September 11, 2026, onward, a manufacturer that determines that a vulnerability in one of its products is being actively exploited in the wild has 24 hours to notify ENISA and a designated national CSIRT simultaneously through the EU's Single Reporting Platform, 72 hours to file a detailed follow-up, and 14 days after a mitigation is available to file a final report.

Knowing when those hours have started is the hard part, because a newly exploited flaw may sit in one product and not another, in a version that never reached customers, or in code that ships but never runs. Most teams work through those questions by hand, across years of releases, during the same hours the notification is due. Most products under the CRA are self-assessed, which makes a manufacturer's own evidence the thing standing behind every filing. A company that cannot produce that evidence when European authorities or its own customers ask loses the right to sell into the market.

Present and Reachable in the Build You Shipped

Finite State analyzes the compiled firmware a manufacturer ships, rebuilding an inventory of what is inside the build—including components a supplier delivered without source—then establishing whether each vulnerable function can execute and recording the reasoning. When an exploited vulnerability surfaces, a manufacturer searches that record to find every affected product on the market and confirm whether the vulnerable code can run. A product security lead can then spend the first of those 24 hours writing the notification, instead of establishing whether one is required.

"The clock does not start when a vulnerability is published. The clock starts when a manufacturer determines that its own product is affected and that someone is exploiting the flaw, and that determination is a judgment call made under time pressure," said Doc McConnell, Head of Policy and Compliance at Finite State. "Making that call well requires an accurate picture of what is inside the product and whether the vulnerable code can run there. Without that picture, reporting becomes a scramble to reconstruct facts you should already have."

Quectel Wireless Solutions, a global end-to-end IoT solutions provider that has used Finite State for independent testing since 2023, built that record before the regulation asked for it.

"We started this work before any regulator asked us to, and that head start is why we’re ready for September 11," said Omar Aamer, Cybersecurity Compliance Manager at Quectel Wireless Solutions. "When an enterprise customer or an authority asks what is inside a module and what we decided about it, we produce the document rather than the promise."

September 11 Is the First Deadline, Not the Last

The remaining CRA obligations, including the essential cybersecurity requirements and the technical documentation package, apply from December 11, 2027, and the same record supports them, because each asks a version of the same questions. What is in this product? What is known to be wrong with it? What did you do about it? Those questions travel beyond Europe as well, into FDA premarket submissions, ISO/SAE 21434 programs, and IEC 62443 documentation, where the filings differ in form while the evidence underneath stays the same.

Finite State also runs this as a managed CRA service, maintaining the SBOM, the monitoring, the disclosure drafts, and the documentation package. Manufacturers can request a CRA consultation at https://finitestate.io/request-cra-walkthrough.

About Finite State

Finite State empowers device OEMs to ship securely while enabling engineering teams to move at the speed of AI, immediately transforming product artifacts into audit-ready assurance through a single automated workflow. Leveraging deep binary analysis and AI-native execution, the platform unifies code, compiled components, and firmware in minutes—connecting security design with deployed software. By continuously generating SBOMs, VEX, and signed compliance packages, Finite State enables connected device companies across industries such as medical devices and automotive to meet evolving regulations, including the EU Cyber Resilience Act (CRA), and deliver continuous compliance at speed. Learn more at https://finitestate.io/

Contacts

Media contact: Finite State Media Relations | press@finitestate.io