The EU Cyber Resilience Act's 24-hour clock: reporting obligations six weeks in

Since 11 September 2026, anyone who makes software or connected hardware for the EU market has had 24 hours to warn the authorities about an actively exploited vulnerability. Six weeks in, here is what the Cyber Resilience Act’s reporting rules require, who they catch, and why a British vendor cannot treat this as somebody else’s paperwork.

What changed on 11 September

The Cyber Resilience Act, Regulation (EU) 2024/2847, mostly applies from 11 December 2027. One part arrived early. As the Commission’s reporting page puts it: “As of 11 September 2026, manufacturers are required to report actively exploited vulnerabilities and severe incidents impacting the security of products with digital elements.”

Two details make this bigger than it sounds. First, according to the Commission’s announcement, the obligations “apply to all products with digital elements made available in the EU, including those already on the market.” There is no grandfathering for the router you shipped in 2021. Second, the trigger is active exploitation of a vulnerability in your product, not a breach of your own network. A researcher’s proof of concept circulating on a forum is one thing; evidence of attackers using it is what starts the clock.

The three deadlines

Report	Deadline	Applies to
Early warning	Within 24 hours of becoming aware	Actively exploited vulnerabilities and severe incidents
Full notification	Within 72 hours of becoming aware	Both
Final report	No later than 14 days after a corrective measure is available	Actively exploited vulnerabilities
Final report	Within one month of the 72-hour notification	Severe incidents

Source: European Commission, Cyber Resilience Act reporting obligations.

The 14-day final report deserves attention from product security teams. It runs from when a fix or mitigation is available, so a vendor that ships a patch on day three owes a final report by about day seventeen. That rewards having the write-up drafted while the fix is in testing, not after.

One platform, one recipient

Manufacturers report once, through the CRA Single Reporting Platform run by ENISA, which went live on 11 September. The notification goes to the CSIRT designated as coordinator in the member state where the manufacturer has its main establishment, and is made available to ENISA at the same time. That CSIRT then passes it to CSIRTs in every other member state where the product is sold.

There is a safety valve. In exceptional cases, on justified cybersecurity grounds, the coordinating CSIRT may delay passing the information on. The Commission adopted a delegated act on 11 December 2025 setting out when that applies, according to its reporting page. Vendors worried about details of an unpatched flaw spreading across 27 national teams will want to read it.

Who is caught, and who is spared

The duty falls on manufacturers of “products with digital elements”, which covers most software and connected hardware sold in the EU. Open-source software stewards, meaning foundations and similar bodies that support open-source projects used commercially, have reporting obligations under Article 24(3), but those start on 11 December 2027.

On penalties, Article 64(2) of the Regulation, in the Official Journal text, provides that breaching the essential requirements in Annex I or the obligations in Articles 13 and 14 “shall be subject to administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 2,5 % of the its total worldwide annual turnover for the preceding financial year, whichever is higher.” The reporting duties sit in Article 14. Whoever drafted the stray “the its” was presumably working to a deadline of their own.

Article 64(10), as corrected on 2 July 2025 (corrigendum OJ L 2025/90555, which changed ‘paragraphs 3 to 9’ to ‘paragraphs 2 to 9’, so the carve-out reaches the Article 64(2) fines), carves out two groups. Fines do not apply to manufacturers that qualify as micro or small enterprises “with regard to any failure to meet the deadline referred to in Article 14(2), point (a), or Article 14(4), point (a)”, which is the 24-hour early warning. Nor do they apply to “any infringement of this Regulation by open-source software stewards.” Small firms still have to report; they are simply not fined for missing the first deadline.

Why it matters on this side of the Channel

The UK is outside the CRA, but a UK company that sells products with digital elements into the EU is a manufacturer under it. The reporting duty attaches to the product on the EU market, not to where the company is based. For a British firm without an EU establishment, working out which CSIRT is the coordinator is worth settling before the first real report, not during it. Article 14(7) sets the order: the CSIRT where the authorised representative is established, then the importer, then the distributor, then the member state with the most users. Article 14(8) adds a separate duty to tell people: after becoming aware of an actively exploited vulnerability or a severe incident, the manufacturer must inform the impacted users, and where appropriate all users, and, where necessary, tell them about any risk mitigation and corrective measures they can deploy. ENISA has published guidance, FAQs and training materials for the platform.

There is also a domestic overlap coming. The UK’s Cyber Security and Resilience Bill proposes its own 24-hour initial notification and 72-hour full report for incidents. A UK managed service provider that also sells a software product into Europe may, in due course, have two regulators, two clocks and two forms for what is fundamentally one bad week.

What product teams should do now

Define “aware”. The 24 hours start when you become aware of active exploitation. Agree internally who can make that call, and log when they did.
Register and rehearse. Get access to the Single Reporting Platform and run a tabletop that ends with a real draft early warning.
Wire threat intelligence to product security. Exploitation evidence often reaches a SOC or a customer first. Make sure it reaches the people who own the product.
Inventory what is on the market. Because legacy products are included, you need to know what you still sell, or still support, in the EU.
Prepare for December 2027. The reporting rules are the first instalment. The essential requirements and conformity assessment are the larger one.

For the UK equivalent, see the Cyber Security and Resilience Bill at Lords Report stage. More is in Regulation & Standards.

The EU Cyber Resilience Act’s 24-hour clock: reporting obligations six weeks in