REGULATORY INSIGHT

EU Cyber Resilience Act reporting — records that let you show you met the 24-hour, 72-hour and 14-day deadlines

22 October 2026

Who has to show what, and from when

Since 11 September 2026, manufacturers of products with digital elements placed on the EU market have been obliged to report actively exploited vulnerabilities and severe incidents affecting the security of their products (Regulation (EU) 2024/2847, Article 14 and Article 71(2)). The Regulation as a whole applies from 11 December 2027; the reporting duty simply arrived first.

Manufacturers outside the EU are covered — Article 14 goes as far as specifying where they must report. And the duty extends to products already on the market before full application (Article 69(3)). Devices and software made in Japan and sold in the EU through importers or distributors are inside these deadlines.

What the Regulation sets out

• Actively exploited vulnerabilities: an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours, and a final report within 14 days of a corrective or mitigating measure becoming available (Article 14(2))
• Severe incidents: an early warning within 24 hours (including whether unlawful or malicious acts are suspected), an incident notification within 72 hours, and a final report within one month of the notification (Article 14(4))
• Channel: reports go through the Single Reporting Platform operated by ENISA and reach the coordinating CSIRT and ENISA simultaneously. The platform went live on 11 September 2026
• Where non-EU manufacturers report: determined in turn by the Member State of the authorised representative, the importer, the distributor and, failing those, the Member State with the most users
• Informing users: affected users must be told about mitigating and corrective measures. If the manufacturer does not do so in good time, the CSIRT may
• What has to be in place first: identifying and documenting components and vulnerabilities, including a software bill of materials, a coordinated vulnerability disclosure policy and a contact point (Annex I, Part II). Technical documentation is kept for ten years after placing on the market or for the support period, whichever is longer (Article 13)
• Fines: breaches of Article 14 up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher (Article 64(2)). Micro and small enterprises are not fined for missing the 24-hour early warning (Article 64(10))

The Commission’s guidance of July 2026 indicates that vulnerabilities known before the date of application need not be reported retrospectively; a report is required where exploitation occurs, or comes to the manufacturer’s attention, after that date.

Where it gets difficult in practice

1. The clock starts at awareness of exploitation. Unless it is settled which channel inside the company, receiving which information at what time, counts as “becoming aware”, you cannot show afterwards that you were inside 24 hours
2. Whether a report is needed depends on which versions of which products contain the affected component. If software bills of materials are not kept for each shipped version, scoping eats the time and the 72-hour notification rests on guesswork
3. When sales run through importers and distributors, the manufacturer may not know which Member State’s CSIRT coordinates. The basis for that determination has to be recorded product by product
4. The content moves from early warning to notification to final report. Without versions of what was known and what was reported at each stage, you cannot explain how the account changed

Carry it by hand, or build it in

There are two ways to meet a requirement like this. One is to carry it by hand: write the procedures and have people check and record. The other is to build in a mechanism that leaves the record you will be asked for as a matter of course.

The first is quicker to start, but it breaks down as the procedures and the people involved multiply. Exceptions accumulate, the granularity of the record drifts, and you lose the ability to establish the scope afterwards. The second puts the design effort up front, but keeps you able to check after the event.

We research and develop technology that carries conformity with regulation as a mechanism rather than as manual routine, and we hold the results as patent applications. See Domains for more.

We follow these rules as they come into force. Updates are available by RSS.

← Back to Insights