The Cyber Resilience Act (CRA) introduces significant new obligations for manufacturers to report actively exploited vulnerabilities and severe security incidents within strict timeframes. This session will examine what these reporting requirements mean in practice, who is responsible, what must be reported, and how organisations can build effective processes to ensure compliance. Attendees will gain practical insights into meeting their regulatory obligations while strengthening incident response and product security governance.