Remote maintenance:
Manufacturers report to ENISA, operators to the BSI

Suppose the control cabinet of a refrigeration system holds a gateway with a cellular SIM card. The service provider uses it to read out fault messages, and its technician changes parameters from a laptop with a service tool, without driving out to the site. On a Monday, the gateway's manufacturer publishes a security advisory. A vulnerability in the VPN access is being actively exploited.

Since 11 September 2026, two reporting obligations with the same deadline attach to this device. Under the Cyber Resilience Act, CRA for short, the manufacturer must report the vulnerability within 24 hours to the EU Agency for Cybersecurity, ENISA. If this leads to a significant security incident at the operator, the operator must likewise report it within 24 hours to the Federal Office for Information Security (BSI) under the new German BSI Act (BSIG), provided it falls under the Act. The service provider that uses the access every day is not automatically obligated itself.

Gateway and service tool are products, and their manufacturer reports

The CRA, Regulation (EU) 2024/2847, covers under Article 3 every software or hardware product with digital elements, including its remote data processing. This includes the gateway in the control cabinet, the router with VPN function and the maintenance software on the laptop. A cloud platform counts only if the product could not perform one of its functions without it. Products already covered by the EU regulations on medical devices or on the type-approval of vehicles are excluded. A manufacturer is anyone who develops or has developed such a product and markets it under its own name. That can also be a service provider with its own remote maintenance software.

Article 14 has applied since 11 September. If a vulnerability is actively exploited, the manufacturer submits an early warning within 24 hours, a notification follows within 72 hours, and the final report is due at the latest 14 days after a fix is available. For severe security incidents, the manufacturer has one month for the final report. The report goes simultaneously to the national computer security incident response team (CSIRT) designated as coordinator and to ENISA. ENISA's reporting platform launched in a first stage on 11 September. Under Article 69(3), the obligation also applies to gateways that were placed on the market years ago.

For operators, Article 14(8) matters most. Under it, the manufacturer must inform the affected users and tell them about remedial measures. If the manufacturer knows only the service provider that installed the device, its notice lands there and not with the operator.

The operator reports to the BSI if it exceeds the thresholds

The German act implementing the NIS2 Directive (EU) 2022/2555 has restated the BSI Act. It was published in the Federal Law Gazette on 5 December 2025 (BGBl. 2025 I Nr. 301), and the obligations have applied since the day after. Under § 28 BSIG, an important entity is one that operates in a sector of Annex 1 or 2 and has at least 50 employees, or more than €10 million each in annual turnover and balance sheet total. Companies in the sectors of Annex 1, including energy, health, transport and water, count as essential entities from 250 employees, or from more than €50 million in turnover together with a balance sheet total above €43 million. Annex 2 names, among others, mechanical engineering, the manufacture of electrical equipment, vehicle manufacturing and medical devices.

Under § 33, affected entities had to register with the BSI within three months. That deadline has passed, the BSI states. As of 30 September, the BSI counted 20,373 registrations. It had expected almost 30,000, and in the fourth quarter the agency plans to contact companies that have not registered, first with a hearing, reports ChannelPartner. For a missed registration, § 65 provides a fine of up to €500,000.

The operator must report a significant security incident, meaning one that causes or can cause severe operational disruption or financial loss. The BSI names three stages: an initial report within 24 hours, a follow-up report within 72 hours, and a final report at the latest one month after that.

The service provider comes in through the supply chain

Which measures the operator must take is set out in § 30 BSIG. They should reflect the state of the art and must be documented. The minimum scope includes supply chain security, the handling of vulnerabilities in the acquisition and maintenance of IT systems, access control and multi-factor authentication. A remote maintenance access touches each of these points. The BSI recommends committing suppliers contractually to security requirements and agreeing service level agreements with them on incident handling and patch management. Dial-in solutions via analog or ISDN modems and controllers connected directly to the internet do not meet the state of the art, according to the BSI recommendation on remote maintenance in industrial environments.

Under § 38, management must implement and oversee the measures. If it culpably breaches this duty, it is liable to the entity under corporate law. It must also take part in training regularly. The BSI presented an example curriculum for this on 28 October. Violations of risk management and reporting obligations can cost essential entities up to €10 million or 2 percent of total turnover under § 65, and important entities up to €7 million or 1.4 percent, in each case whichever is higher.

From December 2027, the manufacturer must commit to updates

From 11 December 2027, the manufacturer must set a support period under Article 13 of at least five years, unless the product is expected to be in use for a shorter time. Under Annex I, updates must be provided free of charge and without delay, and under Annex II, the end date of support accompanies the product. One exception matters for business customers: for custom-made products, the manufacturer and the business user may agree otherwise.

Annex III lists routers, modems for the internet connection and products with VPN function as important products of Class I. If their manufacturer does not apply harmonized standards, or none exist yet, it must go through a procedure with external assessment under Article 32, such as EU-type examination. These standards are arriving later than planned. On 10 November, the European Commission extended the delivery deadlines by three months for all product-specific standards and some horizontal ones. Whether they will be in the Official Journal by December 2027 remains uncertain.

A joint reporting portal is not in sight for now

In the Digital Omnibus of 19 November 2025, the European Commission proposed pooling incident reports under NIS2 and other rules at a central ENISA body. The member states want national reporting points instead, with ENISA operating only an information point without a reporting function. Thirty months are to pass before this applies. That is the position of the Council of 21 October 2026, reports the law firm Cuatrecasas. The European Parliament has not yet settled on a position. Until further notice, manufacturers and operators report through separate portals.

What operators should settle with their service provider now

• Access log: Every remote session runs through a personal account with multi-factor login, is approved by the operator and is logged with person, time and asset. New products must be able to record access from December 2027 anyway (Annex I CRA).
• Inventory: a list of all gateways, routers, modems and service tools with manufacturer and software version. Dial-in modems and openly reachable controllers belong on the replacement list.
• Update commitment: for each device, the end of the support period, the deadline within which security updates are installed, and who pays for it. For custom-made products, record whether updates remain free of charge.
• Reporting route: The service provider passes on manufacturers' security advisories and its own incidents without delay, within a deadline in hours that fits the operator's 24-hour deadline.
• Contacts: a named person on each side for security matters, reachable at night and on weekends too. Plus the manufacturer's contact point for vulnerability reports.

Operators below the thresholds do not have to report anything to the BSI. The manufacturer notices under Article 14 still concern them, because the vulnerable gateway sits in their control cabinet. Whether such a notice arrives there in time can be set in the service contract.