What the Cyber Resilience Act Requires Within 24 Hours of an Exploited Vulnerability

Reporting duties under the EU Cyber Resilience Act began on 11 September 2026. From that date, manufacturers of products with digital elements must notify authorities when they learn of an actively exploited vulnerability or a severe incident affecting one of their products. The European Commission says the regulation’s main obligations apply from 11 December 2027.

The regulation entered into force on 10 December 2024, according to Arthur Cox. The reporting rules reach products already sold in the EU, according to Skadden’s reporting guide.

Who Must Report and Which Products Are Covered

The duty falls on manufacturers of products with digital elements. Skadden describes these as connected software and hardware made available in the EU, including products offered for free, such as mobile apps and IoT devices. Back-end or cloud services that those products need in order to function are also covered.

Skadden says the reporting duties apply regardless of when a product was first released. Arthur Cox says they apply to all products with digital elements on the Union market.

Skadden notes that identifying the regulated manufacturer can be difficult in intragroup supply chains and white-labelling arrangements. It also says recent European Commission guidance narrows the scope of back-end systems.

Importers and distributors have different duties. Arthur Cox says they are not subject to the same reporting obligations or timelines. They must notify the manufacturer when they become aware of a vulnerability, and they must withhold or recall non-compliant products.

Open-source software stewards become subject to reporting obligations on 11 December 2027, according to the Commission’s reporting page. Arthur Cox adds that any natural or legal person may voluntarily report vulnerabilities, threats, incidents and near misses.

Key Dates
The European Commission says manufacturers’ reporting duties under the Cyber Resilience Act apply from 11 September 2026, while the regulation’s main obligations apply from 11 December 2027.

The Two Events That Trigger a Notice

A notice is required for two kinds of events. The first is an actively exploited vulnerability in a product with digital elements. The second is a severe incident that affects the security of such a product.

Skadden describes a severe incident as one that negatively affects a product’s ability to protect important data or functions, or that leads to the introduction or execution of malicious code.

Skadden says the reporting obligation does not strictly require reported vulnerabilities to be fixed. Vulnerability-handling obligations, which start in December 2027, require security risks to be addressed through updates during the support period.

The Three-Stage Reporting Clock

The first stage is an early warning, due within 24 hours of the manufacturer becoming aware of the issue. The Commission’s page and Skadden both give this deadline. The second stage is a detailed notification due within a further 48 hours, which makes 72 hours from first awareness, according to Arthur Cox.

The final report depends on the type of event. For an actively exploited vulnerability, it is due within 14 days after a corrective measure becomes available. The Commission, Skadden and Arthur Cox all give this period.

For a severe incident, the final report is due within one month. The Commission and Arthur Cox count that month from the 72-hour notification; Skadden counts it from the date the incident occurred.

Taken together, the first two stages run from the point the manufacturer becomes aware of an event. The final report for a vulnerability runs from the date a corrective measure becomes available.

The reporting duties reach products already on the market, not only products released after the regulation took effect.

Where Notices Go, Who Else Is Told and What Customers Receive

Notices are filed through the Single Reporting Platform, which ENISA has established. The Commission says the platform is operational as of 11 September 2026. Manufacturers report only once. The notice goes to the national computer security incident response team (CSIRT) in the country of the manufacturer’s main establishment, and ENISA receives the same information at the same time unless exceptional circumstances apply.

The Commission says the receiving CSIRT must share the notice without delay with every other CSIRT in whose territory the product was made available. Arthur Cox describes this step as passing the information to other affected Member States.

A CSIRT may delay that sharing in exceptional circumstances, on justified cybersecurity-related grounds. The Commission says a delegated act adopted on 11 December 2025 sets out the terms for those grounds.

Customers are covered separately. If an actively exploited vulnerability or severe incident affects users, the manufacturer must notify them and describe steps they can take to reduce risk, Skadden says. Skadden says that this notice has no strict deadline or required format.

Regulator notifications are usually not made public, according to Skadden. CSIRTs may inform users directly if a manufacturer has not notified them of an exploited vulnerability in a timely manner, or if public awareness is needed to prevent or mitigate a severe incident.

Where a vulnerability sits in a third-party component, such as an open-source library, the manufacturer must inform the component’s maintainer and share any patch.

Penalties, Guidance and Later Deadlines

Arthur Cox says fines can be up to 15 million euros, depending on the obligation breached. For undertakings, fines can be up to 2.5% of worldwide annual turnover for the preceding financial year.

The Commission published non-binding guidance on 27 July 2026. The guidance is set out in Communication C(2026) 5252 and its annex. It contains 67 practical examples, a range of use cases, flowcharts and graphs, with particular attention to microenterprises and SMEs.

The Commission says it paid particular attention to microenterprises and SMEs, with the aim of keeping compliance clear and proportionate.

The guidance covers whether certain products fall within scope, including remote data processing and free and open-source software. It also addresses what counts as a substantial modification, how support periods apply, and how to meet reporting and risk assessment requirements.

The guidance is part of the Commission’s simplification agenda, alongside the Digital Omnibus published in November 2025.

Skadden says the remaining obligations, including conformity assessments for new products, apply from 11 December 2027. Arthur Cox lists further milestones: notification provisions from 11 June 2026, a target of 11 December 2026 for sufficient conformity assessment bodies, and the publication of additional standards and supporting materials on 30 October 2027.