The EU’s Cyber Resilience Act Starts a 24-Hour Clock on Vulnerability Disclosure

Manufacturers selling internet-connected products in the European Union now have to report actively exploited vulnerabilities within 24 hours of finding out about them. The mandatory disclosure duties under Article 14 of the EU’s Cyber Resilience Act became applicable on September 11, 2026, and the reporting channel companies are required to use, ENISA’s new Single Reporting Platform, opened for submissions the same day.

The rule applies to any manufacturer that places a “product with digital elements” on the EU market, regardless of where the company itself is based. That covers hardware and software with a network or device connection: routers, IoT devices, connected machinery, standalone software applications, and digital components sold separately from a finished product. Critically, the obligation is not limited to new products. Anything already on the market before the CRA’s main requirements take full effect in December 2027 is still covered by today’s reporting duty.

What Article 14 Actually Requires

The CRA sets up a three-stage notification clock that starts the moment a manufacturer becomes aware of a problem:

• Within 24 hours: an early warning notification.
• Within 72 hours: a more detailed technical notification.
• Within 14 days of a fix or mitigation becoming available (for vulnerabilities), or within one month of the initial 72-hour notification (for incidents): a final report.

Two categories of events start that clock. An “actively exploited vulnerability” is a flaw where, per the CRA’s own definition as summarized by compliance resource cyberresilienceact.eu, “there is reliable evidence that a malicious actor has exploited it in a system without the owner’s permission.” A vulnerability a vendor finds and patches before anyone exploits it does not have to go through this channel. A “severe incident” is broader: any event that “negatively affects, or is capable of negatively affecting, the product’s ability to protect the availability, authenticity, integrity or confidentiality of data or functions.” The same 24-hour, 72-hour, final-report timeline applies to both.

One Report, One Platform, One Authority

Manufacturers don’t need to notify multiple national bodies separately for the same event. Per the European Commission’s official CRA reporting guidance, companies report only once, through the CRA’s Single Reporting Platform, and the notification is automatically routed to the Computer Security Incident Response Team responsible for the country where the manufacturer has its main EU establishment. Unless “particularly exceptional circumstances” apply, that CSIRT and ENISA both receive the report at the same time. Manufacturers based outside the EU follow separate rules to determine which CSIRT coordinates their case. Companies also have to tell affected users about exploited vulnerabilities or severe incidents without undue delay once a fix or mitigation is available.

Darren Anstee, CTO for security at network security vendor Netscout, told The Register the tight window is deliberate. “The 24-hour window in which an initial warning must be reported creates a level of urgency, with subsequent deadlines ensuring that the gathering and release of additional information is prompt,” he said. “Better, more rapid sharing of information helps organisations put defences and mitigating controls in place when they know there is heightened risk.”

The Price of Missing the Window

Failing to meet the Article 14 deadlines is not a minor paperwork violation. Under Article 64 of the CRA, breaches of Annex I’s essential cybersecurity requirements and breaches of the reporting duties in Articles 13 and 14 both sit in the top penalty tier: fines of up to 15 million euro (about 17.4 million dollars) or 2.5 percent of a company’s total worldwide annual turnover from the prior financial year, whichever is higher. That is the same top tier reserved for a company that ships a product failing the CRA’s baseline security requirements outright. Two lower tiers cover other violations: up to 10 million euro or 2 percent of turnover for problems like inadequate vulnerability handling or documentation, and up to 5 million euro or 1 percent for supplying incorrect or incomplete information to regulators. National market surveillance authorities set the actual fine case by case, weighing the severity, duration, and scale of the violation alongside the size of the company involved.

Why Compliance Teams Are Nervous

The deadlines are the easy part to describe and the hard part to operationalize. In a client note on the CRA’s reporting obligations, law firm Freshfields warned that “the short reporting windows leave little room to establish processes after an event occurs,” meaning manufacturers need triage and escalation procedures already built before an exploited flaw shows up, not improvised afterward. The firm also flagged a coordination problem that has nothing to do with the CRA’s own text: companies already report security incidents under the NIS2 Directive and personal data breaches under GDPR, and those regimes run on different deadlines and different channels than the CRA’s new Single Reporting Platform. The EU’s planned Digital Omnibus package is meant to eventually consolidate that reporting landscape, but as Freshfields put it, “the Digital Omnibus has not yet consolidated the reporting channels,” so for now a single security incident at a company selling connected products can trigger three separate, differently timed disclosure obligations at once. Deciding whether a given flaw actually clears the “actively exploited” threshold, rather than being merely discovered and quietly patched, is itself a judgment call companies now have to make fast and be ready to defend later.

What Comes Next

Today’s reporting duties are only the first phase to land. Open-source software stewards get a longer runway: their equivalent reporting obligations do not start until December 11, 2027, the same date most of the CRA’s remaining requirements become applicable for everyone else. From that point, manufacturers will also need to build products with security by design and by default, meaning no default passwords and no optional security updates, and will need a conformity assessment and CE marking before a product can reach the EU market. A software bill of materials, optional today, becomes a mandatory part of that assessment.

sxz.io covered Docker’s own explainer on those 2026 and 2027 CRA dates back in June. Today’s rule is the part of the CRA that arrived first, and unlike the design and SBOM requirements still to come, it applies to products already sitting on EU shelves and in EU networks right now, not just to ones built for the new rules. It also lands the same week the EU and UK are pulling in different directions on cyber-incident transparency: the UK’s own Cyber Security and Resilience Bill, covered here earlier this week, currently leaves board-level accountability for cyber failures as a voluntary code rather than a legal duty. The CRA’s Article 14 deadlines carry no such opt-out.