It’s the sale in the EU that counts
The CRA applies to products with digital elements made available on the market, and the market is the EU’s (Articles 2(1) and 3(22)). What triggers the obligations is a product sold in the EU, not where its manufacturer is based. A Norwegian company that sells its own products under its own name to customers in Sweden, directly or through a reseller, is a manufacturer under the Regulation for those products.
Nkom says the same: a manufacturer established in Norway can be covered by Article 14 for products made available in the EU (Nkom, 11 September 2026, in Norwegian).
What already applies
Article 14 has applied since 11 September 2026. When you become aware of an actively exploited vulnerability in a product, or a severe incident affecting its security, you send:
- an early warning within 24 hours
- a vulnerability or incident notification within 72 hours
- a final report: for a vulnerability, no later than 14 days after a fix or mitigation is available; for an incident, within a month of the notification
You also inform the users affected (Article 14(8)). The reports go to a CSIRT and to ENISA at the same time, through ENISA’s Single Reporting Platform (SRP), in operation since that same day. What each report must contain is in the CRA playbook.
Older products count too
The reporting duty isn’t limited to new products. Under Article 69(3), Article 14 applies to every product in scope placed on the market before 11 December 2027. A gateway you sold in Denmark in 2021 is covered if you become aware today that a vulnerability in it is being actively exploited.
Who you report to
With no establishment in the EU, Article 14(7) decides the country: where the authorised representative for most of your products is established, otherwise the importer that places most of them on the market, otherwise the distributor that sells the most, otherwise the country where most of your users are. With an establishment in the EU, a branch for example, reports go to the country where decisions on your products’ cybersecurity are mainly taken, or else where you have the most employees in the EU.
Reporting from Norway walks through the route step by step, and the route finder gives you the CSIRT for your products.
What waits for the EEA Agreement
The CRA is marked as EEA-relevant but hasn’t been incorporated into the EEA Agreement. Until it is:
- it doesn’t apply to products sold only in Norway
- Nkom can’t receive reports, and Norwegian authorities can’t supervise or sanction under the CRA
- reports on the products you sell in the EU go to a CSIRT in an EU country
The government has said Nkom will supervise the CRA in Norway, and the 2027 budget proposal adds NOK 3.9 million for Nkom’s follow-up of the CRA (Nkom, 7 October 2026, in Norwegian). No date has been set for when the Regulation applies in Norway. From that day it covers products sold only in Norway too, and reports can go to Norwegian authorities.
What to do now
- List the products you sell in the EU, including older models still in use.
- Work out your reporting route: who represents, imports and distributes most of your products in the EU.
- Give two people access to the SRP, each with an EU Login account and multi-factor authentication.
- Decide who can send an early warning within 24 hours, weekends and holidays included.
- Agree how you’ll reach users with advice on what to do.
