Manufacturers must now report exploited flaws in their products within 24 hours
The reporting obligations of the Cyber Resilience Act (Regulation (EU) 2024/2847) apply from September 11, 2026, and ENISA's single reporting platform has been operational since that day.
Our take If you manufacture or market under your own brand a product with software, whether a connected device or an application, a 24-hour clock is already running. That requires knowing who receives vulnerability alerts, who decides whether there is exploitation and who has access to the ENISA platform. Rehearse the process with a simulated case before the first real one arrives.
Manufacturers must now report exploited flaws in their products within 24 hours
The reporting obligations of the Cyber Resilience Act (Regulation (EU) 2024/2847) apply from September 11, 2026, and ENISA's single reporting platform has been operational since that day.
If you manufacture or market under your own brand a product with software, whether a connected device or an application, a 24-hour clock is already running. That requires knowing who receives vulnerability alerts, who decides whether there is exploitation and who has access to the ENISA platform. Rehearse the process with a simulated case before the first real one arrives.