In partnership with
The European Union has started the Cyber Resilience Act’s first mandatory reporting phase for products with digital elements.
The reporting duty took effect on September 11, 2026, before the Act’s wider requirements begin in December 2027.
The European Commission says manufacturers must report actively exploited vulnerabilities affecting their products.
Meet the Founder Reimagining How We Farm
Clint Brauer returned to his family farm after his father developed Parkinson’s. What began as a personal mission became Greenfield Robotics: robots designed to replace herbicides with mechanical weed control.
Born from a farmer’s personal mission
Replace herbicides with mechanical weed control
Help reduce chemical exposure in farming
Investors in this round can qualify for up to a 20% bonus.
This Reg A+ offering is made available through StartEngine Primary, LLC, member FINRA/SIPC. Please read the Offering Circular and related disclosures before investing. This investment is speculative, illiquid, and involves a high degree of risk, including the possible loss of your entire investment.
They must also report severe incidents that affect the security of those products.
The process applies to products with digital elements made available on the European Union market.
The scope therefore reaches beyond traditional software vendors.
It can include connected devices, embedded software, applications, and other products covered by the regulation.
The legal trigger is not simply the discovery of a theoretical weakness.
The Commission describes the immediate obligation around active exploitation and severe security incidents.
Manufacturers must submit an early warning within 24 hours of becoming aware of an actively exploited vulnerability.
They must submit a fuller notification within 72 hours.
For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective measure becomes available.
For a severe incident, the final report is due within one month of the 72 hour notification.
These stages create different information requirements rather than one single disclosure.
An early warning can establish that authorities need to prepare for a developing issue.
The Future of AI in Marketing. Your Shortcut to Smarter, Faster Marketing.
This guide distills 10 AI strategies from industry leaders that are transforming marketing.
Learn how HubSpot's engineering team achieved 15-20% productivity gains with AI
Learn how AI-driven emails achieved 94% higher conversion rates
Discover 7 ways to enhance your marketing strategy with AI.
A fuller notification can add technical and impact information as the manufacturer confirms more facts.
The final report records the response after a corrective measure or incident process advances.
ENISA operates the Single Reporting Platform for these notifications.
The platform is intended to let a manufacturer report once while routing relevant information to national computer security incident response teams and competent authorities.
ENISA says the platform became operational on the same day the reporting obligations applied.
Its instructions also describe registration, notification submission, updates, and exceptional circumstances.
The system changes the operational question from whether a company has a public disclosure page.
The more important question is whether it can recognize a qualifying event and preserve the time of awareness.
That requires a documented path between security monitoring, product engineering, legal review, incident response, and the reporting function.
It also requires evidence that can support the first warning before the technical investigation is complete.
The regulation does not make every software weakness automatically reportable under the September phase.
Organizations must determine whether the product and incident fall within the legal conditions.
They must also distinguish a signal from confirmed awareness of active exploitation.
That distinction matters because the reporting clocks are measured in hours.
The Commission’s guidance is therefore more useful when read with the regulation and ENISA platform instructions.
The obligation also has a later boundary for open-source software stewards.
ENISA states that their related reporting duty under Article 24 applies from December 11, 2027.
Stop Dabbling With AI and Start Earning With It
Ready to stop using AI as a search engine and start using it as an income engine?
The Hustle's "200+ AI-Powered Income Ideas" is your free playbook for turning the most overhyped technology of our time into actual cash.
Inside you'll find:
200+ real, vetted ways to generate income with AI, spanning freelance services, digital products, content creation, and emerging markets
Actionable strategies built for non-engineers, so your technical background (or lack of one) won't hold you back
Ideas aligned with where the market is actually heading, not where it was two years ago
Subscribe free today and unlock the full guide. The people already cashing in aren't smarter than you, they just started earlier.
That later date does not remove the present manufacturer obligation for covered products.
The staged timetable means one compliance calendar cannot be treated as the entire Act.
The current phase is a reporting and coordination test for product makers.
It places emphasis on detection, decision records, contact ownership, and accurate notification timing.
It also gives national authorities a common intake path for incidents that cross borders.
The practical result is a new evidence requirement inside product security operations.
Teams need to know which product is affected, when exploitation became credible, what corrective measure exists, and which report stage is due.
The regulation does not remove technical uncertainty, but it does reduce the time available to manage it.
