Articles on the CRA

Answers to the questions Nordic manufacturers ask about the Cyber Resilience Act: reporting, vulnerability handling and what applies in Norway.

1. Pharus with Claude and other AI agents: how the MCP server works

   The Pharus MCP server lets an AI assistant such as Claude read your workspace, register a vulnerability and draft a CRA report for you to review. It can’t start a clock, decide, file or send anything: that stays with a person signed in to Pharus. Here’s how it works, how to connect one, and where your data goes.

   13 November 2026

2. Do small companies get fined for missing the CRA’s 24-hour deadline?

   Not for missing the 24-hour early warning, if you’re a micro or small enterprise. The early warning is still required, and the exemption doesn’t cover the 72-hour notification, the final report or medium-sized companies.

   12 November 2026

3. A CRA early warning, filled in: an example

   An early warning only needs what you know within 24 hours: the product, the versions, where it’s sold and when you became aware. Here is one filled in, field by field, for a made-up gateway maker, with what comes after.

   9 November 2026

4. When is a vulnerability “actively exploited”, and when does the 24-hour clock start?

   When, after a quick initial assessment, you’re reasonably certain that a vulnerability in your product is being exploited by a malicious actor. The 24 hours start then, not when the investigation is done. A vulnerability in a third-party component is only reportable when it’s exploited in your product.

   5 November 2026

5. Does the CRA apply to Norwegian manufacturers before it’s part of the EEA Agreement?

   Yes, for everything you sell in the EU. The duty to report actively exploited vulnerabilities and severe incidents has applied since 11 September 2026, including to products placed on the market before then. What waits for the EEA Agreement is Norwegian supervision, and products sold only in Norway.

   2 November 2026