In this Help Net Security interview, Aurimas Bakas, CEO of Copla, talks about what the EU Cyber Resilience Act‘s reporting duties mean for manufacturers. He explains why companies need a register of every product version still in use, why boards focus on CE marking while reporting obligations started in September 2026, and how to define the moment a company becomes aware of an exploited flaw.
He also covers what CISOs should ask suppliers, and how a weekend tabletop exercise shows whether a team could file within 24 hours.
Article 14 covers products sold years ago. How long is the tail of devices still in use?
In my experience, it’s almost always longer than the team expects. It’s easy listing the current catalogue, but I worry more about the firmware a customer installed in 2021 and never touched again. Article 14’s reporting duty covers products that are already on the market, so that version still counts even if companies stopped selling it years ago.
I learned this in regulated finance, when we were the vendor. Banks never asked us what we were selling that year. They asked what was running in their systems right now, and we had to answer for every version of it.
So I’d start with a register before a policy. For every product version still in use, you want to know who runs it and whether you can still ship a fix for it. If you don’t know a customer is running a version, you have no way to warn them when it gets exploited, and the 24-hour early warning becomes very hard to meet. A good test is to pick a product you stopped selling in 2020 and ask who would hear first if it were exploited tomorrow, you or your customer.
Fines reach €15M or 2.5% of turnover. Why do boards still think “CE marking” instead of incident response?
Mostly because December 2027 is the date in every headline, and the CE mark is something a board can picture. A technical file and a label look like a project with an end date, so it gets planned like one.
Reporting started on 11 September 2026, and it doesn’t have an end date. The team has to be able to send an early warning within 24 hours on any day of the year, including the week everyone is on holiday, and failing to report falls under the same €15 million or 2.5% ceiling as the rest of the regulation.
I’ve seen this with other frameworks. A customer once told me they got ISO 27001 in three weeks. I asked if they had done anything to get there, and they said nothing at all. I asked if they felt any more secure, and they said no.
The question I’d put to a board is a different one. If someone told us today that a flaw in our product is being exploited, could we file the early warning by this time tomorrow? I’d want the answer to include the name of the person who would do it.
The clock starts at awareness, and awareness is scattered. How do companies pin down that moment, and who starts the clock at 2am on a Sunday?
I’d write down what “aware” means for your company before you ever need it. It’s one sentence in the incident process, and it saves a long argument in the middle of an incident.
Then the signals need to land in one place. Most teams watch the security mailbox, but fewer think about what customers tell sales or support. If a customer tells your account manager their device is being attacked, the company knows, even if security doesn’t yet.
For 2am on a Sunday, I’d name one person on call with the authority to start the clock, and a backup for when they can’t be reached. ENISA’s reporting platform lets a manufacturer register a primary representative and up to 20 secondary ones, and at launch filing is a web form behind EU Login with multi-factor authentication. So check that whoever is on call this weekend has an account and can log in from home.
When they decide, they should record the time and the reason straight away. If a regulator later asks when you became aware, you want to show a log entry made at the time. Tools can collect and flag the signals, but I’d keep the decision with a named person.
Customers now have leverage over suppliers. What should a CISO put in contracts and ask in reviews, and which answers should worry them?
For years I was on the other side of that table. I sold core banking software to banks, and we had to prove our security to every one of them, so I know which questions are hard to fake.
In the contract I’d want a time for how quickly the supplier tells you about an actively exploited flaw in what you use. It should be in hours, and it shouldn’t come later than their own 24-hour early warning to the authorities. I’d also want a named security contact with a phone number, and a stated support period for each product version you run. The CRA expects that period to be at least five years for most products, so ask what it is for your version specifically.
In reviews, ask when they last practised filing an incident report and who is on call this weekend. Ask to see the software bill of materials for the version you run.
The answers that would worry me are “we’ll report as soon as we can” with no hours attached, or “that’s covered by our ISO certificate”. “We’ve never had an exploited vulnerability” usually means nobody has been looking. And a supplier that can’t tell you which versions you’re running has no way to warn you about them.
One exercise next quarter: what tells a team most about whether it could file within 24 hours, and what breaks first?
I’d run a tabletop that starts on a weekend from a realistic signal, like a customer emailing support to say they think your device is being attacked. Don’t warn the security team in advance, and keep going until there’s a finished early-warning draft and a named person has signed it off. Most exercises stop once the problem is spotted, and that’s where the hard part starts.
Time each handover as you go, from the signal to someone deciding and from the decision to a signed draft. Write those times down, because they’re the real result of the exercise. ENISA’s survey of SMEs this year found incident response was the weakest area for companies of every size, so I wouldn’t expect the plan to hold on the first run. I’d also check something basic during the exercise: can the person on call log in to ENISA’s reporting platform on a Sunday, with their own account and their own second factor?
Strategies: CISSP exam prep with ISC2 experts
