Athens: From the offices of the Union’s cybersecurity agency, officials are counting down to a date most consumers have never heard of. On 11 September 2026 the first hard obligations of Europe’s cyber resilience law switch on, and every company that sells a product with a chip or a line of code inside it will feel the change.
The Cyber Resilience Act sets baseline security rules for what Brussels calls products with digital elements, a category that sweeps in everything from smart doorbells and routers to industrial software. From September, manufacturers must report actively exploited vulnerabilities and severe incidents to authorities, feeding a single platform that the Athens-based agency ENISA is building now.
What the cyber resilience rules demand
The reporting clock is unforgiving. A manufacturer that learns of an exploited flaw must file an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days of shipping a fix. The full weight of the law, covering secure design, updates and documentation, lands later, on 11 December 2027, but the reporting duties arrive first and catch firms that have never had to disclose a breach to a regulator.
The economic logic is plain. Insecure connected devices have become a soft underbelly for the whole single market, letting attackers hijack home cameras or creep into factory lines. By forcing security into products before they ship, the Union treats cyber resilience as a matter of economic security rather than a niche technical concern.
Why compliance will strain smaller firms
Large vendors already run vulnerability teams and can absorb the paperwork. The strain falls on the thousands of small manufacturers and importers who build hardware on thin margins and have never staffed a security function. For them, a 24-hour reporting window is not a formality but an operational overhaul, and the fines for ignoring it reach into the millions or a slice of global turnover.
Open-source developers add another wrinkle. Lawmakers softened the rules for volunteers who give code away for free, yet the line between a hobby project and a commercial component stays blurry, and maintainers worry the law will push liability onto people who never sold anything. ENISA’s reporting platform also has to work on day one, because a single overloaded portal would undercut the whole regime.
The law also collides with rules firms already juggle. A connected medical device answers to product-safety and medical regulations as well as the cyber code, and a car or a factory sensor sits under its own sectoral regime. Manufacturers now have to map which incident goes to which authority under which clock, and getting that wrong carries its own penalties. Trade bodies want clearer guidance before September, warning that overlapping duties could bury small firms in duplicate filings.
The deadline is close enough that intentions no longer matter. Firms that started preparing in 2025 will meet September comfortably; those still treating the law as a distant abstraction are about to discover how little runway remains. Europe has decided that the cost of insecure devices belongs with the companies that make them, and in six weeks that decision stops being theory.
