The European Union has started enforcing Cyber Resilience Act reporting deadlines for manufacturers that sell connected or software-enabled products in the bloc. From September 11, 2026, makers of products with digital elements must file an early warning within 24 hours of learning about an actively exploited vulnerability or a severe security incident, submit fuller details within 72 hours through ENISA’s Single Reporting Platform, and later provide final reports on fixes or mitigations.
Why it matters: This changes the clock for vendors worldwide that sell into the EU and should speed up disclosure of real-world exploited flaws and major product security incidents. Manufacturers need reporting processes in place now, and defenders should expect faster official notice when products they use are under active attack.
2026.09.11
100% relevant
This article establishes a new trackable event: the CRA’s Article 14 reporting obligations became applicable on September 11, 2026, creating a new operational and regulatory disclosure regime for exploited vulnerabilities and severe incidents.
← Back to all stories