Oulu: Hardware firms in this Finnish engineering cluster ship routers, sensors and industrial controllers across the single market, and from 11 September 2026 the Cyber Resilience Act gives them one day to tell regulators when someone is actively exploiting a flaw in those products. The date sits fifteen months ahead of the bulk of the law, and it catches devices that left the factory years ago.

The obligation is narrow but sharp. Manufacturers must send an early warning to ENISA and to the relevant national CSIRT within 24 hours of learning that a vulnerability in one of their products with digital elements is under active exploitation. A fuller technical notification follows within 72 hours. A final report closes the file within 14 days for a vulnerability, or within one month for a severe incident.

• 24 hours – early warning to ENISA and the national CSIRT
• 72 hours – technical notification with mitigation detail
• 14 days – final report on an actively exploited vulnerability
• One month – final report on a severe incident
• 11 December 2027 – the remaining obligations start to apply

The scope catches more companies than many boards expect. The reporting duties cover products already circulating in the Union, not only devices placed on the market after September. A firm that sold a connected pump in 2023 and still supports it carries the same 24-hour clock as a vendor launching next month.

ENISA carries the plumbing. Article 16 obliges the agency to run a single reporting platform with an electronic endpoint for every member state CSIRT, so a manufacturer files once and the receiving CSIRT circulates the notification onward to ENISA and to other affected states. The agency has confirmed the platform will be operational by 11 September and has signalled a testing period beforehand. The Commission sets out the mechanics in its guidance on Cyber Resilience Act reporting.

Twenty-four hours sounds generous until you count what fits inside it. A security team must confirm the exploitation is real, identify the affected products and versions, assemble technical detail and clear the disclosure internally before the notification leaves the building. Legal and communications sign-off usually sits somewhere in that chain, and weekends do not stop the clock.

The rule also overlaps with duties firms already carry. The NIS2 directive imposes its own incident notification timetable on essential and important entities, and the GDPR adds a 72-hour breach clock wherever personal data is involved. A single intrusion can trigger all three, each with a different recipient and a different threshold, which is why compliance teams are mapping the routes now rather than in September.

Background explains the sequencing. The Cyber Resilience Act entered into force on 10 December 2024 as the Union’s first horizontal cybersecurity law for products, replacing a patchwork of sectoral rules and voluntary codes. Its central bargain asks manufacturers to build security into the design, maintain it across a defined support period and disclose failures quickly, in exchange for one CE-marked route to the whole market. The essential requirements, conformity assessment and technical documentation duties apply from 11 December 2027.

September therefore works as a rehearsal with real consequences. National authorities will see, for the first time, which manufacturers can find and describe their own exploited flaws inside a day and which cannot. That record will shape how firmly those authorities approach the heavier obligations waiting at the end of 2027.