450 machines in the field, no SBOM — and the reporting duty has been live for five weeks

This is the first of our practice cases: situations from conversations with machine builders, anonymised to an archetype, in five fixed sections. Having read it, you should be able to decide whether this is your problem and what solving it costs. The last section says what Resilic does not solve. It is the reason to believe the rest.

The situation

A machine builder with some 450 units in the field, customers in pharma and food, controllers and industrial PCs from three suppliers, plus remote-maintenance access. The service department knows which machine stands where: in people’s heads, in Excel and in the order files. There is no inventory of the software inside. Whether the firmware of a 2019 controller carries a known vulnerability, the company learns when the supplier writes a letter or the customer calls. Since 11 September 2026 this company must report actively-exploited vulnerabilities and severe incidents to ENISA, and that means all 450 machines in the field.

What the law requires

Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847) has applied since 11 September 2026. It requires a cascade of reports through ENISA’s Single Reporting Platform, counted from the moment the manufacturer becomes aware: an early warning within 24 hours, a notification within 72 hours and a final report: for a vulnerability no later than 14 days after a corrective or mitigating measure is available, for an incident within one month of the 72-hour notification. Article 14(8) also requires informing the impacted users, where appropriate in a structured, machine-readable format.

The question that comes first in every conversation: does this apply to the old machines too? Yes. Article 69(3) expressly provides that Article 14 applies to all products with digital elements placed on the market before 11 December 2027. There is no age limit, no exemption for discontinued series and no five-year rule. The law’s five-year figures concern the support period and the log under the Machinery Regulation, not the reporting duty.

Just as important is what Article 14 does not require. Until 11 December 2027 the CRA does not require of this company:

• a software bill of materials (SBOM) for the machines in the field. That is a duty under Article 13 and Annex I, and for machines placed on the market before 11 December 2027 it applies only if they are substantially modified after that date;
• secure-by-design, full vulnerability handling or CE marking under the CRA for the existing fleet;
• a report for every known vulnerability. What is reported is what is actively exploited, and what constitutes a severe incident.

So the task is not "become fully CRA-compliant" but: be able to report. Know within 24 hours which of the 450 machines contain the affected component, and file a report that meets the platform’s requirements. That is a matter of readiness.

What has to be done anyway

None of this needs a tool. Whoever gets through the following with spreadsheets and discipline is able to report:

• Know the fleet: per machine the customer, the site, the controller, the industrial PC and the firmware versions, from the order files, from service, if need be from a visit on site.
• Read the suppliers’ vulnerability sources: the security advisories of the controller and IPC manufacturers, the European vulnerability database EUVD, CISA’s KEV catalogue for what is actually being exploited.
• Settle the terms internally: who decides whether a vulnerability is "actively exploited" and an incident "severe", and within how many hours.
• Prepare the reporting point: the platform requires an Assigned Representative with an EU Login account and multi-factor authentication. ENISA advises registering only when a report is due; a pending validation by the coordinating CSIRT does not block the submission.
• Rehearse the process once: a fictitious vulnerability, start the clock, walk the three stages, prepare the user information.

Where Resilic shortens the path

Resilic is built for exactly this situation: a fleet in the field, little inventory, a reporting duty already running. As of October 2026 it shortens the path here:

• A product register with versions and deployments: which machine runs at which customer at which site, with a customer portal through which the operator confirms its machines.
• A software bill of materials per version, uploaded, assembled from components or captured by Resilic Edge in the control cabinet: a scanner on the machine network that uses read-only queries to detect which devices and firmware versions answer.
• Correlation against EUVD, NVD and the KEV catalogue with an AI triage that brings the actively-exploited match to the top and shows which deployments are affected.
• Reportable events with a running 24-hour and 72-hour clock, reminders, an AI draft per stage and the sign-off of a person who signs. An event declared in error is withdrawn, never deleted; the audit trail stays.
• Export in the platform’s field format (glossary v1 of 10 September 2026), with the recorded notifying entity and the Primary and Secondary Assigned Representative, to transfer to the platform field by field.
• CSAF security advisories with customer notification as evidence that users were informed.

What it does not solve

Four things you should know before you believe us:

• Resilic does not reconstruct what went into a machine in 2018. Resilic Edge sees what answers on the network, not what is inside a firmware. The bill of materials of an old machine comes from your files, your service and your suppliers; Resilic records and correlates it.
• Resilic does not file a report. The Single Reporting Platform offers no interface at its launch; the export is transferred to the platform by your Assigned Representative. That is the intended route.
• Resilic does not decide whether a vulnerability is actively exploited or an incident severe. It shows the KEV listing, the score and who is affected; the classification and the signature stay with you.
• Resilic does not turn an old machine into a compliant product. The duties from 11 December 2027 remain your work. We help you approach them on the same data; being able to report is the first step.

If you recognised yourself in the situation: the free CRA scope check shows in five questions which deadlines apply to you. And if your situation looks different, write to us. The next practice case comes from a conversation like this one.