Manufacturers using Finite State’s platform can trace whether an actively exploited flaw exists in shipped firmware in minutes, as the EU’s first CRA reporting window opens
The European Union’s Cyber Resilience Act (CRA) stops being theoretical this week. Starting September 11, 2026, connected device manufacturers selling into the EU face their first hard reporting obligation under the law — and according to Finite State, a product security and software supply-chain risk management firm, customers on its platform are already positioned to meet it.
Why September 11 Matters
The CRA’s initial reporting rule is narrow but unforgiving. Once a manufacturer determines that a vulnerability in one of its products is being actively exploited in the wild, the clock starts on a three-stage disclosure obligation: a 24-hour early warning to ENISA and a designated national CSIRT through the EU’s Single Reporting Platform, a 72-hour detailed follow-up, and a final report due 14 days after a fix becomes available.
The rule applies broadly — from home routers to industrial controllers — and it doesn’t exempt products that shipped years before anyone was drafting the regulation, as long as they remain under support.
The Hard Part Isn’t the Paperwork
According to Finite State, the real bottleneck isn’t drafting the notification itself — it’s answering the question underneath it: is this specific vulnerability actually present, and can it actually run, in a specific product a company has already shipped? A newly disclosed exploit might affect one product line and not another, might sit in a firmware version that never reached customers, or might ship inside a build without ever executing. Sorting that out normally means manually cross-referencing years of releases — under the same 24-hour clock the regulation imposes.
Because most products fall under the CRA’s self-assessment track, the burden of proof sits with the manufacturer. Doc McConnell, Finite State’s Head of Policy and Compliance, framed the stakes this way: the reporting clock doesn’t start when a vulnerability becomes public — it starts the moment a manufacturer can show its own product is affected and being exploited, a judgment call that has to be made under pressure and backed by an accurate picture of what’s actually inside the build.
What Finite State’s Platform Does
Finite State’s approach centers on analyzing the compiled firmware a manufacturer actually ships — not just the source code or design documents — to build an inventory of everything inside the build, including third-party components that arrive without accompanying source. From there, the platform determines whether a given vulnerable function is reachable and executable, and preserves the reasoning behind that determination.
The payoff, per Finite State, is speed at the moment it counts: when a newly exploited vulnerability surfaces, a manufacturer can search that existing record to identify every affected product on the market and confirm whether the vulnerable code path can run — turning the first hour of a 24-hour reporting window into drafting time rather than investigation time.
A Customer That Got Ahead of It
Quectel Wireless Solutions, a global IoT solutions provider that has used Finite State for independent testing since 2023, is cited as an early example of this approach paying off. Omar Aamer, Quectel’s Cybersecurity Compliance Manager, said the company began building its evidence record before any regulator required it — which he credits as the reason Quectel is ready for the September 11 deadline. When a customer or regulator asks what’s inside a given module and what the company decided about it, he said, Quectel can produce documentation rather than assurances.
This Is the First Deadline, Not the Last
September 11 opens the CRA’s reporting obligations, but it isn’t the finish line. The law’s broader requirements — including its essential cybersecurity requirements and full technical documentation package — take effect December 11, 2027, and Finite State argues the same underlying record supports both. In each case, regulators and customers are ultimately asking a version of the same three questions: what’s in the product, what’s known to be wrong with it, and what did the manufacturer do about it.
Finite State notes those questions extend well past the EU as well, surfacing in comparable form in FDA premarket submissions, ISO/SAE 21434 automotive cybersecurity programs, and IEC 62443 industrial-control documentation — different filing formats built on the same underlying evidence.
Services Beyond the Platform
For manufacturers building toward the 2027 deadline, Finite State also offers a broader, services-led path to compliance. Its consulting arm pairs former government cybersecurity officials, regulatory compliance veterans, and embedded-systems specialists — collectively citing more than 20 years of offensive security expertise — with the automated analysis platform. Services span three phases:
- Assessment & Strategy — gap analysis, a custom compliance roadmap, risk prioritization, and security architecture review.
- Technical Implementation — automated security testing, supply chain verification, vulnerability management setup, and continuous monitoring.
- Documentation & Support — technical documentation preparation, CE marking guidance, Declaration of Conformity support, and ongoing compliance maintenance.
The company positions the combination as a way to compress certification timelines, cut manual review work, and avoid late-stage redesigns or certification bottlenecks — while also, in the nearer term, keeping manufacturers on the right side of the CRA’s first live deadline.
Finite State also offers a managed CRA service for manufacturers that want the SBOM maintenance, monitoring, disclosure drafting, and documentation package handled directly. Manufacturers can request a CRA consultation at finitestate.io/request-cra-walkthrough.
