The European Union's Cyber Resilience Act has entered a new phase, with mandatory reporting obligations for manufacturers taking effect on September 11, 2026. From that date, companies must report actively exploited vulnerabilities and severe security incidents affecting products with digital elements — any software or hardware product and its remote data processing, from connected cameras and smart TVs to industrial machines.
The rules apply not only to EU companies. Any manufacturer outside the EU that places such products on the European market, including UK-based firms selling into the EU, falls under the reporting duties set out in Article 14 of the regulation.

Tight deadlines for reporting

A manufacturer that becomes aware of an actively exploited vulnerability must file an early warning with the designated national Computer Security Incident Response Team and the EU Agency for Cybersecurity simultaneously, through a single reporting platform. The early warning is due within 24 hours of awareness, followed by a fuller notification within 72 hours and a final report no later than 14 days after a fix or mitigating measure is available. Similar clocks govern severe incidents.

Penalties and next milestones

Non-compliance carries significant penalties of up to 15 million euros or 2.5 percent of global annual turnover. The bulk of the Act's substantive requirements, including conformity assessment and CE marking, apply from December 11, 2027. Observers note the reporting platform itself was only finalized days before the deadline, leaving manufacturers racing to comply.