The EU Cyber Resilience Act's reporting duties are live

Since 11 September 2026, manufacturers of software and connected hardware supplied in the European Union have had to report actively exploited vulnerabilities and severe security incidents in their products, starting with an early warning within 24 hours of becoming aware. The duty is Article 14 of the Cyber Resilience Act, Regulation (EU) 2024/2847, the first of the Act's obligations on manufacturers to apply, and it covers products already on the market. It matters to anyone who ships an app, desktop tool, firmware or other installable software to EU users, and much less to teams that only build websites. This is a summary, not legal advice.

What has to be reported

Article 14 covers two kinds of event.

• An actively exploited vulnerability: one for which there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission. A flaw found in your own testing, with no sign that anyone has used it, does not meet that definition on its own.
• A severe incident affecting the product's security: one that harms, or could harm, the product's ability to protect sensitive or important data or functions, or that has led or could lead to malicious code running in the product or on a user's systems.

The deadlines

The first two clocks start when the manufacturer becomes aware.

• Within 24 hours: an early warning, naming the Member States where you know the product is available. For an incident, say whether you suspect unlawful or malicious acts.
• Within 72 hours: a notification covering the product, the nature of the exploit or incident, the measures taken, and what users can do.
• Final report: for a vulnerability, no later than 14 days after a corrective or mitigating measure is available; for a severe incident, within one month of the 72-hour notification.

The coordinating CSIRT (computer security incident response team) can ask for an intermediate report. You must also tell affected users, and where appropriate all users, about it and what they can do to limit the impact.

Reporting is not retrospective. ENISA, the EU Agency for Cybersecurity, says in its FAQ that exploitation a manufacturer knew of before 11 September 2026 need not be reported, but exploitation it learns of later must be, even in an older flaw.

Where reports go

Reports go through ENISA's Single Reporting Platform, launched on 11 September 2026. One notification reaches both ENISA and the CSIRT designated as coordinator in the Member State of your main EU establishment, where decisions about your products' cybersecurity are mainly taken. A manufacturer with no main establishment in the EU follows a set order, starting with the Member State of its authorised representative.

If the platform is down, ENISA says to file once it is back, and to contact your CSIRT directly in the meantime if a report cannot wait.

Who is a manufacturer, and what is in scope

The Act covers products with digital elements made available on the EU market whose intended or reasonably foreseeable use includes a data connection to a device or network. Such a product is software or hardware together with its remote data processing, so desktop and mobile apps are included, paid or free, when supplied as part of a commercial activity.

A manufacturer is whoever develops a product, or has it developed, and markets it under its own name or trademark. That wording points to the client when an agency builds an app the client publishes under its own name, and to you for software you sell or give away under yours.

Software offered purely as a service is generally outside the Act. Its recitals point software-as-a-service providers to the NIS2 Directive and put websites that do not support a product's functionality out of scope. The exception is remote data processing a product needs to work, such as an API or database its manufacturer built for a mobile app. Settle where your own products sit with counsel.

Fines and the next date

Article 64 sets fines of up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher, for breaching the essential cybersecurity requirements or the obligations in Articles 13 and 14. Member States set the detailed rules. A July 2025 correction spares micro and small enterprises fines for missing the 24-hour early warning, but not the later deadlines.

Article 64 itself applies from 11 December 2027, along with the rest of the Regulation, including the essential requirements products must meet. Ask counsel when fines for reporting failures can first be imposed.

What to do now

1. List what you make available in the EU, whose name each product is marketed under, and whether it relies on a service you run.
2. For client builds, agree in writing whose name each product carries and who files reports. The Act's definition, not the contract alone, decides who the manufacturer is.
3. Work out which CSIRT is your coordinator.
4. Publish a security contact, with a named person who can file an early warning within 24 hours, weekends included, and who has the EU Login account with multi-factor authentication that the platform requires. ENISA advises registering on the platform itself only when there is something to report.
5. Read ENISA's FAQ and user manuals before you need them, and decide how you will tell users: a security notices page, an email, or both.

Sources

• Regulation (EU) 2024/2847, the Cyber Resilience Act: Articles 2, 3, 14, 64, 69 and 71, and recitals 11 and 12
• Corrigendum to Regulation (EU) 2024/2847, 2 July 2025: Article 64(10)
• European Commission: Cyber Resilience Act
• European Commission: Cyber Resilience Act reporting obligations
• ENISA: The CRA Single Reporting Platform is launched
• ENISA: Single Reporting Platform frequently asked questions