EU Cyber Resilience Act: reporting starts on Friday
From 11 September, makers of software and connected products sold in the EU must report actively exploited vulnerabilities within 24 hours.
The EU Cyber Resilience Act applies in full from December 2027, but its first obligation starts this Friday, 11 September 2026. Manufacturers of “products with digital elements” on the EU market, which covers most software and connected devices, must report actively exploited vulnerabilities and severe security incidents.
The timeline is tight:
- An early warning within 24 hours of becoming aware.
- A fuller notification within 72 hours.
- A final report later, once a fix or mitigation is available.
Reports go through ENISA’s single reporting platform to the relevant national CSIRT. It applies to products already on the market, not just new ones.
If you sell software or devices into Europe:
- Decide who is responsible for reporting, with a backup.
- Make sure vulnerability reports from customers and researchers reach that person fast.
- Write the first-24-hours steps down now. You won’t have time to work them out on the day.