EU Cyber Resilience Act: reporting duties apply from 11 September 2026. What charger and inverter makers must do

#Timeline

#What must be reported, and how fast

The clock starts when the manufacturer becomes aware. Reports are submitted once, through the Single Reporting Platform. They go to the CSIRT designated as coordinator in the member state of the manufacturer’s main establishment and, unless exceptional circumstances apply, to ENISA at the same time.

An incident is severe if it affects, or could affect, the product’s ability to protect the availability, authenticity, integrity or confidentiality of data or functions, or if it leads or could lead to malicious code running on the product or the user’s systems.

Manufacturers must also inform affected users, and where appropriate all users, about the vulnerability or incident and the available mitigations, where appropriate in a structured, machine-readable format.

#Products already on sale count too

Products placed on the market before 11 December 2027 are generally subject to the CRA only after a substantial modification (Article 69(2)). The reporting duty is the exception: Article 14 applies to all such products in scope, with no modification needed (Article 69(3)). Your installed base in the EU is in scope now.

#Are chargers, inverters and storage systems covered?

The CRA covers products with digital elements that connect to a device or a network. A charger with OCPP, an inverter with Wi-Fi or 4G monitoring, a storage system with a cloud platform, or an energy management unit all fit that description.

None of these products is named in Annex III (important products) or Annex IV (critical products). Annex III lists, for example, routers and modems, operating systems and smart home products with security functions. Annex IV lists smart meter gateways. Products not listed fall into the default category, for which the manufacturer can assess conformity itself from December 2027.

Until then, connected radio equipment sold in the EU must already meet the cybersecurity requirements of the Radio Equipment Directive, assessed with EN 18031.

#What to do now

1. Set up a 24-hour route. Decide who receives vulnerability reports, who judges whether a vulnerability is actively exploited, and who files the early warning.
2. Prepare access to the Single Reporting Platform and identify the CSIRT that will receive your notifications.
3. List your installed base. Every connected model sold in the EU, with firmware versions and the way updates reach the field. The duty reaches back to older products.
4. Prepare user notices. Templates and a channel for advisories, ideally machine-readable.
5. Plan for December 2027. Secure-by-default design, security updates for the support period, and a software bill of materials become requirements.