Brussels: Cyber Resilience Act reporting became mandatory on 11 September 2026, and manufacturers of connected products across the European Union now face a 24-hour clock whenever they learn of an actively exploited vulnerability. The duty applies to every maker of hardware or software with a digital element sold on the EU market, wherever the company is based. ENISA, the EU cybersecurity agency, runs the single platform where those alerts must land.

The rules come from Regulation (EU) 2024/2847, which entered into force in late 2024. Most of its design and conformity duties start only on 11 December 2027, so Cyber Resilience Act reporting arrives first. That sequence gives national authorities and manufacturers a live test of the system fifteen months before the main obligations bite.

Two triggers set the clock running. A manufacturer must report an actively exploited vulnerability, meaning one with reliable evidence that a malicious actor has used it. It must also report a severe incident that affects, or could affect, the product’s ability to protect sensitive data or functions, or that lets malicious code run.

Under Cyber Resilience Act reporting, the deadlines come in stages. Companies send an early warning within 24 hours of becoming aware of the problem, then a fuller notification within 72 hours. For an exploited vulnerability, the final report follows no later than 14 days after a fix or mitigation becomes available, and for a severe incident the final report falls due within one month of the notification.

Manufacturers file once, and the message reaches two recipients. The notification goes at the same time to the computer security incident response team (CSIRT) of the member state where the company has its main establishment and to ENISA through its Single Reporting Platform. The European Commission also published implementation guidance in July 2026 to help firms prepare.

Importers and distributors should not assume the duty bypasses them. A distributor that sells a product under its own name or trademark, or substantially modifies it, takes on the manufacturer’s role and the reporting burden that comes with it. Smaller firms that rely on open-source components will need internal processes that spot exploitation quickly enough to meet the 24-hour mark.

Legal advisers describe the single filing as the most practical feature of Cyber Resilience Act reporting, because one notification serves both the national CSIRT and ENISA. The design spares companies from sending parallel alerts to up to 27 national bodies. Cyber Resilience Act reporting also gives ENISA a Union-wide view of exploited vulnerabilities in connected products as they emerge.

For compliance teams, the practical message is simple. Build an incident contact point, map every product to the right main-establishment CSIRT, and rehearse the 24-hour early warning before a real vulnerability forces the test. Cyber Resilience Act reporting rewards firms that treat a security alert as a legal clock rather than a technical footnote in 2026.