Glossary · OT cybersecurity
Severe incident (CRA)
Also known as: Severe incident having an impact on the security of the product, CRA incident reporting
German: Schwerwiegender Sicherheitsvorfall (CRA)
Under the Cyber Resilience Act, a severe incident is an incident having an impact on the security of a product with digital elements that negatively affects, or is capable of affecting, the product’s ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or that has led or can lead to the execution of malicious code; manufacturers must report it from September 11, 2026.
- OT security
In one sentence
Severe incident under the CRA: an incident that impairs a product’s security functions. Early warning in 24 h, notification in 72 h, final report in a month.
Example
A manufacturer of connected heat pumps finds that its cloud assistant was manipulated into sending a malicious configuration to devices; it sends an early warning via the single reporting platform within 24 hours.
Explained in context
This term is a station of a mini course
- When an AI agent crosses the line: detect, contain and restore operationsStation: Check the reporting duties · Connected products and their appsStart the course
Context cards connect this term with others to answer one question. Also in British English and German.
- Reporting duties after an AI agent incident: AI Act, CRA, NIS 2 and GDPRWhen an AI agent has caused an incident, which EU reporting duties can apply — who reports, to whom, and by when?UKDeutsch
- When an AI agent crosses the line: detect, contain and restore operationsWhat has to be in place when an AI agent does something it isn’t allowed to do — in IT systems, IoT fleets, OT and on machines — and how is it detected, stopped and released again?UKDeutsch
How it applies
- Deadlines: Early warning within 24 hours of becoming aware, incident notification within 72 hours, final report within one month after the notification — through the single reporting platform to the CSIRT designated as coordinator and to ENISA. The manufacturer also informs the impacted users.
- Applies since: September 11, 2026 for products with digital elements on the market; the main obligations of the Cyber Resilience Act follow on December 11, 2027.
- AI agents in products: An agent that is part of a product with digital elements — in a device, its app or its remote data processing — is part of the product's security. A manipulated agent that changes device configurations can be a severe incident.
- Not the same as NIS 2: NIS 2 obliges essential and important entities to report significant incidents of their own services; the CRA obliges manufacturers about their products. A company can be under both.