EU Cyber Resilience Act Reporting Duty Started on 11 September 2026: What Manufacturers Now Have to Do in 24 Hours

On September 11, 2026, Article 14 of the EU Cyber Resilience Act took effect: manufacturers of devices and software with digital elements must notify ENISA of actively exploited vulnerabilities and serious incidents. Early warning is due within 24 hours, extended notification within 72 hours, and a final report after remediation. Fines reach €15 million or 2.5% of global turnover.

• Early warning to ENISA within 24 hours of awareness
• Extended notification with details and versions within 72 hours
• Requirement also covers goods placed on the market before December 11, 2027
• Fines up to €15 million or 2.5% of global annual turnover