# CRA: Could Your Team Report a Vulnerability in 24 Hours?

- Author: Michael Mikus (https://mikus.io/about/)
- Published: 2026-11-06
- Type: Event
- Event: Wed Nov 25, 2PM CET / 8AM ET; Online, 45 minutes
- Registration: https://my.demio.com/ref/V3JYkin8zmjR5XYB
- Web page: https://mikus.io/signals/2026-11-06-cra-24-hour-reporting-webinar/

A webinar on the Cyber Resilience Act's 24-hour clock. Since [11 September 2026](/signals/2026-09-11-cra-first-reporting-deadline/), manufacturers selling connected devices in the EU must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability in their product, followed by a full notification within 72 hours. That includes manufacturers outside the EU, such as US companies selling through EU distributors.

The 45-minute session follows a realistic incident hour by hour, from the first email to the final report, and covers what the CRA expects of your firmware by December 2027. You leave with a readiness test and a checklist for your team. It is practical, not legal advice, and aimed at engineering leads, product security, and anyone accountable for the CRA in their company.

It's a Spotflow webinar, where I work, presented by Jan Kučera, Spotflow's co-founder. Registration is free.