Irish software firms must meet EU Cyber Resilience Act reporting from 11 September

From 11 September, Irish companies that develop or market software under their own name are required to comply with the EU Cyber Resilience Act’s Article 14 reporting obligations.

The Act covers a wide range of products, including downloadable clients, mobile apps, embedded firmware, freemium software and any product that connects to a device or network. Under EU law, a “manufacturer” is any person or company that creates or commissions digital‑element products and markets them under its own trademark, provided the activity is commercial.

Software supplied free of charge and not monetised falls outside the scope, while freemium and open‑source components that generate revenue are included. The regulation demands that products be secure by design, by default and throughout their life‑cycle; non‑compliant items cannot be placed on the EU market.

Two triggers start the reporting clock: an actively exploited vulnerability or a severe security incident. Companies have 24 hours to issue an early warning and 72 hours to submit a severity assessment, followed by final reports within 14 days for vulnerabilities or one month for incidents. Reports are filed via ENISA’s Single Reporting Platform to the national CSIRT‑IE within the NCSC.

Beyond reporting, the Act requires essential cybersecurity measures, CE marking and allows market‑surveillance authorities to demand corrections, withdrawals or recalls. Fines can reach the higher of 2.5 % of worldwide turnover or €15 million, effective from December 2027.

The NCSC published guidance on Article 14 on 31 August and operates a CRA helpdesk, though it will not determine product scope. Ireland’s own cybersecurity legislation, the National Cyber Security Bill transposing the NIS2 Directive, is expected by the end of 2026, but the CRA applies directly without waiting for national law.

Source: Silicon Republic. Photo: Nataliya Vaitkevich / Pexels.