Since 11 September a manufacturer has 24 hours for an early warning, even when the exploited flaw comes from a supplier’s component.

The piece of the week, because it settles where the clock runs. The Commission’s guidance on the CRA, published on 27 July with 67 practical examples, says it in one sentence: "Where a product with digital elements contains an actively exploited vulnerability originating from a third-party component, the manufacturer of the product with digital elements is required to notify that actively exploited vulnerability." The 24 hours start when the manufacturer becomes aware, and the guidance pins that moment down: a customer, an authority, the press or any individual raises something, the manufacturer assesses it "immediately", and it is aware once that initial assessment gives it "a reasonable degree of certainty" that a vulnerability in its product is being exploited. Two limits keep this proportionate. A component flaw that cannot be reached, or has not been exploited, in the manufacturer’s own product is not reportable for that manufacturer. And information flows upstream too: under Article 13(6), which applies from December 2027, the manufacturer reports the vulnerability to whoever makes or maintains the component, and shares any fix it wrote. Open-source stewards, the guidance expects, will usually learn of exploitation from reports about the products their code went into. The guidance is non-binding, and it is the oldest piece this week. The others depend on it.

The view from the contract side. Thomas Kahl and Teresa Kirschner, both in Taylor Wessing’s Frankfurt office, write for the automotive industry, and their first point is that the exception for vehicles is narrower than its nickname suggests. It covers products under Regulation (EU) 2019/2144, not the wall box with a cloud connection, the workshop diagnostic device, the OBD dongle or the vehicle app, and not an OTA update platform offered as a product in its own right. The reporting duty covers products already on the market, and for a company outside the EU, OTA updates alone can establish the link to the EU market. The useful part is their preparation list: clear manufacturer roles in group, white-label and partnership models, escalation that works "at night, on weekends, and when facts are incomplete", and suppliers contractually obliged "to immediately disclose vulnerability, exploit, SBOM, and incident information". They also count what a single incident can set off at once: the CRA, NIS2, the GDPR and, for vehicles, R155 and R156. The clock runs at the manufacturer, and whether its 24 hours are enough is settled earlier, in the supplier contract. What the list leaves open is the price. A supplier asked to report within hours will ask what it gets in return, and that is easier to agree before the first incident than during it.

The path from upstream to plant in a single advisory. On 17 August Red Hat disclosed a critical flaw in Keycloak, the open-source identity and access server, reported by James Paremain: an unauthenticated attacker could skip the email verification in the password reset and take over any account (CVE-2026-18963, CVSS 9.1). Red Hat’s fixed builds followed the next day. Keycloak runs inside Siemens Industrial Edge Management. Siemens put firewall rules in front of the cloud version on 26 August, fixed it on 2 September and published the advisory on 8 September; CISA republished it on 22 September. Cloud users had nothing to do. Whoever runs the Pro or Virtual version has to update to V1.15.20, V2.2.2 or V2.9.1, or until then block direct internet access or switch off the password reset. No public source reports exploitation, and the flaw is not in CISA’s catalogue of exploited vulnerabilities. There was nothing to report under the CRA, and when Siemens published the advisory the duty did not yet apply. Had it been exploited in Siemens’ product, the Commission’s guidance would put the report with Siemens as the manufacturer, and the update would still depend on everyone who runs their own instance. A supplier contract would have done little here: Keycloak is open source, and the CRA’s answer to that is reporting upstream, not a deadline for a vendor.

The same division of labour in a vehicle recall. Chrysler, filing as FCA US, is recalling 844,027 vehicles of the 2026 and 2027 model years in the United States, from the Jeep Wrangler to the Dodge Charger, because radio software may keep the rearview camera image from appearing in reverse. The filing names the component manufacturer, Harman Becker Automotive Systems; the recall is Chrysler’s. The chronology reads well next to the CRA: investigation opened on 7 May, issue recognised on 15 July, non-compliance determined on 6 August, report received by NHTSA on 13 August. That is what "becoming aware" looks like when a committee determines it, in a different regime with a different trigger, a safety standard rather than an exploited vulnerability. The remedy is the part that transfers. Stellantis announced that customers "will receive an over-the-air radio software update across all affected brands", and Fox Business passed that on. The filing says the update comes "via firmware Over-The-Air, if capable/available, or via USB at the dealer", and does not say how many vehicles can take it over the air.

And the German baseline, published the day before the duty began. In the spring, before the Commission’s guidance, Bitkom asked 1,003 companies with ten or more employees: 67 per cent had heard of the CRA, 29 per cent knew what it means for their own company, 38 per cent had heard of it without being able to judge that, and 28 per cent did not know it at all. The headline turns the 29 per cent into "prepared", which is not what was asked: knowing what a law means is not being ready for it, and the sample covers companies in every sector, not only manufacturers of connected products. Bitkom president Ralf Wintergerst supports the law in principle and says it still falls short on practical implementation. Bitkom’s complaint that nobody could register on the reporting platform in advance matters less than it sounds; ENISA advises registering only when there is something to report. For this week the survey is useful the other way round. A manufacturer’s 24 hours depend on suppliers who know what to tell it, and nothing in these numbers suggests suppliers know more than everyone else.