Manufacturers of digital products sold in the EU must now report actively exploited security vulnerabilities and serious cyber incidents under new rules that took effect on 11 September 2026.
The reporting requirements are part of the EU’s Cyber Resilience Act, which covers “products with digital elements” — including hardware and software such as baby monitors, smartwatches, apps and computer programmes, the European Commission informed on Friday.
Companies must submit an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident affecting a product’s security. A full notification must follow within 72 hours.
A final report must be filed no later than 14 days after a corrective or mitigating measure is available for an actively exploited vulnerability, and within one month for a severe incident.
The obligations apply to all relevant products made available in the EU, including those already on the market.
Single reporting platform and enforcement
Manufacturers will submit notifications through the Cyber Resilience Act Single Reporting Platform, which is established and maintained by the European Union Agency for Cybersecurity (ENISA), the Commission said.
The Commission has also published practical guidance for manufacturers, developers and businesses on meeting the new requirements.
Enforcement will be carried out by national market surveillance authorities.
While the reporting duties began on 11 September 2026, the main obligations introduced by the Cyber Resilience Act will apply from 11 December 2027, the Commission said.
