Policy · 47 days ago
Article 14 of the EU Cyber Resilience Act became applicable today, putting manufacturers of products with digital elements sold in the EU on a 24-hour clock for early warning when they learn a vulnerability is actively exploited, with a fuller notification due within 72 hours. The same timetable applies to severe security incidents, and it reaches non-EU manufacturers too if they sell into the bloc.
The reporting goes through ENISA’s Single Reporting Platform to the coordinating CSIRT, with a final report due later: 14 days after a corrective or mitigating measure is available for an exploited vulnerability, or one month after the first report for a serious incident. That turns disclosure into a regulated workflow, not just a security one, because the first filing may have to go out before internal triage is done.
For product makers, the durable exposure is operational and legal: if the team cannot establish when it became aware of active exploitation, or cannot move that fact through security and compliance fast enough, the clock still runs. The law now makes rapid reporting part of vulnerability handling for any vendor with EU customers, not just EU-based companies.
4 sources covering this story
EU Cyber Resilience Act reporting rules take effect, putting vulnerability disclosure and product security in focus.
EU's Cyber Resilience Act starts the 24-hour vulnerability clock
Manufacturers must now disclose actively exploited flaws and severe security incidents through ENISA's new reporting platform
EU Cyber Resilience Act to Enforce New Reporting Requirements
Starting Friday, European organizations will have just 24 hours to notify the EU government any time they discover serious product security incidents.
The EU CRA's Real Question: What Shipped, and When Did You Know?
The EU Cyber Resilience Act's vulnerability reporting requirements take effect September 11, giving software vendors as little as 24 hours to report actively exploited flaws.
Part of the PlainSec briefing for 2026-09-14