Europe's New Cyber Reporting Clock Starts Ticking Before You Have the Full Picture

Manufacturers of connected products have until 11 September 2026 to build incident-reporting machinery that works under pressure — and the deadlines begin the moment a company learns of trouble, not when it understands it.

From that date, makers of digital products sold in the EU must report actively exploited vulnerabilities and serious security incidents affecting product safety. The obligation comes from Article 14 of the European Cyber Resilience Act (CRA), and it demands that firms assess incidents swiftly even when the information at hand is initially patchy. Companies that fail to fix internal responsibilities and reporting channels before the first alarms arrive risk blowing deadlines and facing stiff penalties.

Three clocks, one platform

Statutory reporting deadlines run from the moment of awareness. A first early warning is due within 24 hours, followed by a detailed notification within 72 hours.

Where a vulnerability has been exploited, a final report must be submitted within 14 days of a fix being made available. For serious incidents, that report is due no later than one month after the 72-hour notification.

All submissions go through the central reporting platform of ENISA, the EU cybersecurity agency, which forwards them to Germany's Federal Office for Information Security (BSI), the relevant national CSIRT and ENISA itself.

A theoretical flaw is not enough

The duty does not kick in at mere knowledge of a theoretical security gap. It requires demonstrated, actual exploitation.

Take the flaws in the FatFs software library that security firm Runzero identified in July 2026 in test images for cameras, drones and industrial controllers. As long as no active exploitation is proven, neither component developers nor device manufacturers have to file a report.

Software makers, connected IoT device producers, industrial machinery manufacturers and networking equipment suppliers are among those covered. The obligations apply equally to companies based outside the European Union if they sell their goods in the EU single market.

Third-party software is in scope too, as are products no longer actively sold but still in use. While the duty to supply updates remains tied to the defined support period, a report can still be filed even where there is no longer any legal obligation to fix the flaw.

For smart-home devices such as connected cameras, thermostats and door locks, the legal framework generally provides for a support period of at least five years — longer for durable goods and shorter for short-lived products. The exact end date must be stated at the point of sale, with month and year.

New construction-related product requirements for existing devices sold before 11 December 2027 only bite when substantial changes are made. The reporting duties, by contrast, already bind these products.

Mapping the mess in the factory

In day-to-day industrial operations, the hard part is matching vulnerabilities to specific software versions, product variants and machines already shipped. Trade fairs are showcasing comparison tools that automatically check component and version data against current vulnerability databases.

At national level, member states are still laying the legal groundwork. Germany's Bundestag passed the CRA implementation act on 15 October 2026, based on parliamentary paper 21/6134. It designates the BSI as market surveillance and notifying authority, while accreditation of conformity assessment bodies falls to DAkkS. Italy's Council of Ministers approved a corresponding draft decree on 2 October 2026, making its agency ACN the market supervisor.

Reporting duties are live now. The rest of the Cyber Resilience Act — including essential security requirements, CE marking and the declaration of conformity — only applies from 11 December 2027. Under EU law, breaches carry penalties of up to €15 million or 2.5% of worldwide annual turnover.