Cyber Resilience Act: manufacturers must report exploited flaws within 24 hours

Since 11 September 2026, Article 14 of the EU's Cyber Resilience Act requires manufacturers of connected products to report actively exploited vulnerabilities: an early warning within 24 hours, a fuller notification within 72 hours and a final report within 14 days. Most of the regulation takes effect on 11 December 2027, and the duty also covers products placed on the market before that date.

• Early warning on an exploited flaw is due within 24 hours of the manufacturer becoming aware
• Fuller notification within 72 hours; final report within 14 days of a fix being available
• All reports are filed through ENISA's Single Reporting Platform
• Article 69(3) covers products placed on the market before December 2027