The reporting obligations of the EU Cyber Resilience Act took effect on 11 September 2026. Manufacturers of products with digital elements must now report actively exploited vulnerabilities and severe security incidents affecting their products.
The deadlines are short and cumulative. An early warning is due within 24 hours of becoming aware. A fuller notification follows within 72 hours. For an exploited vulnerability, a final report is due no later than 14 days after a corrective measure becomes available; for a severe incident, within one month of the 72-hour notification. Reports go through the Single Reporting Platform operated by ENISA, which became operational on the same date, and are addressed to the CSIRT of the member state where the manufacturer has its main establishment. That team passes the notification on to the other territories where the product is sold.
Two details catch people out. The clock starts at awareness, not at confirmation, so an unread mailbox is not a defence. And the obligation attaches to the manufacturer placing the product on the market, which includes a company whose firmware comes from a contract developer or a module vendor.
Open-source software stewards have longer: their reporting duties begin on 11 December 2027. Everyone else is already inside the window.
Worth noting is what has not yet started. The essential cybersecurity requirements for products, the conformity assessment and the CE marking obligations under the act apply from 11 December 2027. What began in September is only the duty to tell the authorities when something is wrong, which is deliberately the first piece: it costs nothing to design for and reveals immediately whether a manufacturer knows what is in its own firmware.
Source: European Commission