EU's Cyber Resilience Act starts 24-hour vuln reporting

Manufacturers selling software or connected hardware in the EU must now report actively exploited vulnerabilities within 24 hours of becoming aware of them. Article 14 of the Cyber Resilience Act applies from September 11, 2026.

The obligation applies wherever a company is based. If a product with digital elements reaches EU customers, its manufacturer owes three reports for an actively exploited vulnerability: an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days of a fix being available. Severe security incidents follow the same 24- and 72-hour clocks, with a final report a month after the initial notification.

Reports go through ENISA's Single Reporting Platform. It routes each filing to the coordinating national CSIRT, instead of requiring separate notices to every member state.

The penalties are significant. Breaching the regulation's essential requirements or the manufacturer obligations, including Article 14 reporting, can bring fines of up to €15 million or 2.5% of worldwide annual turnover, whichever is higher. A developer with EU customers now needs a reporting plan ready before an exploited vulnerability appears.

Most of the CRA, including security-by-design requirements and software bills of materials, applies from December 11, 2027. This deadline covers vulnerability and incident reporting only, but it's the first CRA obligation in force, and the one most likely to catch an unprepared team.

Correction, October 23, 2026: an earlier version of this item didn't link the regulation itself. We've added it alongside ENISA's reporting platform.