Grid-tech vendors need a rehearsed CRA reporting process before their SBOMs are due
Grid-tech vendors have had to report actively exploited vulnerabilities and severe incidents under the EU Cyber Resilience Act since 11 September 2026. SBOMs and vulnerability handling become mandatory on 11 December 2027.
The Engineer · Build desk
Timeline. 11 September 2026: the duty to report actively exploited vulnerabilities begins. 14 October 2026, commentary: Gilg could not verify the act was passed and promulgated. 11 December 2027: the SBOM and vulnerability handling duty applies, 15 months after the reporting duty.
| Date | Event | Claim |
|---|---|---|
| September 11, 2026 | Reporting duty for actively exploited vulnerabilities begins | 1 |
| October 14, 2026 | Commentary: Gilg could not verify the act was passed | 19 |
| December 11, 2027 | SBOM and vulnerability handling duty, 15 months after reporting | 16 |
What happened
- Art. 14 sets staged deadlines: an early warning, a more detailed notification, and a final report.
- Under the German government's draft implementation act, the BSI would become the market surveillance authority.
- Smart meter gateways fall in Annex IV as critical products, and firewalls and intrusion detection and prevention systems sit in Annex III, Class II, according to Springlex.
- Violations of Annex I and Articles 13 and 14 can lead to significant fines.
Why it matters
- exposure A telecontrol unit that has run in a substation for years is covered once its manufacturer learns of active exploitation, so the installed base carries the duty, not only new releases.
- decision Vendors have to name, before the first case, who decides on a weekend night whether a vulnerability counts as actively exploited.
- constraint SBOM work has no final format target yet. The BSI calls TR-03183 an aid, and the harmonised standards that will fix the details are still in draft.
The reporting duty comes 15 months before the SBOM duty [16]. Vendors can meet it with the tools they already have, but they need a person with authority to make a call.
Reports go through a platform that ENISA is establishing, according to the BSI [2]. The post we are working from names the three stages of Art. 14 but does not state their time limits [3]. Art. 14 is where to read them.
The CRA applies whether or not Germany passes its implementation act. The regulation applies directly and needs no national transposition [18]. The draft act creates no new obligations; those come from the EU regulation [20]. Gilg still flags its status. He wrote that as of 14 October 2026 he "could not verify that the act has been passed and promulgated" [19].
Scope for grid hardware turns on function. The Commission has clarified the Annex categories technically, and the core function is what counts, according to HSF Kramer [8]. Gilg applies that test. In his assessment an embedded VPN module does not automatically make a substation automation system an "important" product, but a remote access gateway built primarily for VPN can qualify in some cases [9]. Protection devices, RTUs and inverters depend on the individual case [9].
The SBOM target is softer than the date suggests. Part 2 of TR-03183 requires machine-readable SBOMs [10]. Format versions and mandatory fields per component follow the current version of that part [11]. The BSI describes the TR as an aid to implementation, and says the details are meant to be defined by harmonised standards that are still being drafted [12]. A pipeline built to today's version may need rework when those standards land.
Gilg puts rehearsal first: define roles, keep an early-warning template ready, and run the reporting deadlines once against the clock [13]. He maps this to the SANS ICS incident response control and calls the mapping his own assignment [15]. We think the ordering is right for a vendor with units in the field. The duty reaches products placed on the market before December 2027 [5], and the SBOM duty does not apply until that month [4]. The first report may therefore concern firmware that predates any SBOM process.
This is one practitioner's summary of BSI and law-firm material [15], and anything in it should be checked against the regulation text.
What to watch
- Whether the German CRA implementation act is passed and promulgated, which would formally make the BSI the market surveillance authority.
- Publication of the harmonised standards that will fix SBOM details, and any change they force in BSI TR-03183-2.
- Whether the ENISA reporting platform that vendors must use is in operation, since the BSI describes it as still being established.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap−5
- Incentives
- Insufficient
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Since 11 September 2026 (Art. 71 CRA, Regulation (EU) 2024/2847), manufacturers of products with digital elements must report actively exploited vulnerabilities and severe security incidents.
- [2]
Reports go through a reporting platform that ENISA is establishing.
- [3]
Art. 14 CRA provides for staged deadlines: an early warning, a more detailed notification, and a final report.
- [4]
SBOM and vulnerability handling under Annex I become mandatory on 11 December 2027, when all CRA requirements apply.
- [5]
The reporting obligation also covers products that were on the market before December 2027.
- [6]
A telecontrol substation unit that has been running in the field for years and falls within the CRA's scope is covered as soon as the manufacturer learns that a vulnerability in it is being actively exploited.
- [7]
Smart meter gateways in smart metering systems are Annex IV (critical); firewalls and intrusion detection and prevention systems are Annex III, Class II.
- [8]
The EU Commission has clarified the product categories technically; the core function is what counts.
- [9]
In Gilg's OT assessment, an embedded VPN module does not automatically make a substation automation system an important product, whereas a remote access gateway with VPN as its core function can fall under it in individual cases; for protection devices, RTUs and inverters, classification depends on the individual case.
- [10]
BSI TR-03183 has three parts: general requirements for manufacturers and products, formal and technical requirements for SBOMs, and handling of incoming vulnerability reports; Part 2 requires machine-readable SBOMs.
- [11]
Which format versions and mandatory fields per component apply is defined by the respective version of the TR; the current BSI TR-03183-2 is authoritative.
- [12]
The BSI presents TR-03183 as an aid to implementation, and the details are meant to be defined by harmonised standards that are currently being drafted.
- [13]
Gilg's first recommended step is to rehearse the reporting process: define roles, keep a template for the early warning ready, and run the reporting deadlines once against the clock.
- [14]
Gilg's first question for a rehearsal is who decides on a weekend night whether a vulnerability is actively exploited.
- [15]
Max Gilg is an OT cybersecurity expert from Rosenheim; he maps the steps to the SANS Five ICS Cybersecurity Critical Controls and labels the mapping his own assignment.
- [16]
The reporting duty (from 11 September 2026) precedes the SBOM and vulnerability handling duty (from 11 December 2027) by 15 months.
- [17]
Under the German government's draft CRA implementation act, the BSI is meant to become the market surveillance authority.
- [18]
The CRA is Regulation (EU) 2024/2847 and applies directly; no national transposition is needed.
- [19]
Gilg wrote that as of 14 October 2026 he "could not verify that the act has been passed and promulgated."
- [20]
The draft CRA implementation act creates no new obligations; those come directly from the EU regulation.
- [21]
Violations of Annex I and Art. 13 and 14 can lead to significant fines.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toEU CRA and BSI TR-03183: What Grid Tech Vendors Need to Do Now
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.