Heraklion: The Cyber Resilience Act now requires every manufacturer of connected products to report actively exploited vulnerabilities within 24 hours, and the duty has applied since 11 September 2026. The EU cybersecurity agency ENISA opened its Single Reporting Platform on the same day, and the Commission’s guidance page says manufacturers must use it for severe incidents as well.

Three deadlines shape the process. A manufacturer sends an early warning within 24 hours of learning about an exploited flaw or a severe incident, and a fuller notification follows within 72 hours. The final report is due no later than 14 days after a corrective measure becomes available for a vulnerability, or within one month of the 72-hour notification for a severe incident. Under the Cyber Resilience Act these clocks start when the manufacturer becomes aware, so internal escalation matters as much as technical skill.

Manufacturers file once under the Cyber Resilience Act. The notification goes to the national computer security incident response team, known as a CSIRT, in the country of the manufacturer’s main EU establishment, and ENISA receives it at the same time unless exceptional circumstances apply. That team then shares the report without delay with the CSIRTs of every other member state where the product is sold. A delegated act adopted on 11 December 2025 lists the cybersecurity grounds on which a team may delay that sharing.

Practical details come from Help Net Security, which covered the launch on 14 September 2026. Each manufacturer registers through EU Login with multi-factor authentication and names one primary representative and up to 20 secondary ones. At launch the platform offers a web interface only, with no programming interface for automated filing, and it works in English. A wrong choice of coordinating member state can invalidate a notification, so firms should confirm their main establishment before they file.

ENISA Executive Director Juhan Lepassaar said that streamlined reporting and sharing of information on exploited vulnerabilities and severe incidents helps to build a more resilient Digital Single Market. The agency promises FAQs, user guidance, a glossary and training. Voluntary reporting under Article 15 of the Cyber Resilience Act is planned for a later phase.

Open-source software stewards have more time under the Cyber Resilience Act. Their reporting duties under Article 24(3) apply from 11 December 2027, according to Article 71(2). Neither the Commission page nor the press coverage I reviewed mentions fines for missed deadlines, so companies should read the penalty provisions of the text itself.

For device makers the message is operational. Security teams need a named reporter, a 24-hour escalation route and a tested login before the next exploited flaw appears. The first months of the Cyber Resilience Act will show whether the single platform delivers quicker warnings to national teams, and whether small manufacturers can keep up with the speed.