On this page
A 24-hour clock for every exploited vulnerability
The Cyber Resilience Act reporting obligations apply since 11 September 2026. Any company that places software, or a product with software in it, on the EU market reports an actively exploited vulnerability or a severe incident within 24 hours with an early warning, within 72 hours with a notification, and later with a final report. It all goes through one EU platform run by ENISA, which routes it to the national CSIRT in charge.
The rest of the regulation, the secure-by-design rules, updates and CE marking, applies from 11 December 2027. The reporting duty does not wait for that, and it covers products you shipped years ago too. That reaches a Swedish smart-home brand, a Dutch app studio selling its own product and a US SaaS company with a desktop client alike.
Hour 0
You become aware
A vulnerability in your product is actively exploited, or a severe incident hits its security.
24 hours
Early warning
Through ENISA's single reporting platform to the CSIRT of your member state.
72 hours
Notification
What is going on, what you did already, what users can do.
Once you know
Inform users
People using your product learn what is happening and what they can do. If you do not, the CSIRT may.
14 days or 1 month
Final report
14 days after a fix is available for a vulnerability, or one month after the notification for an incident.
One notification through ENISA's single reporting platform reaches the CSIRT of your main establishment and ENISA at once.
Who has to report
The duty sits with the manufacturer: whoever develops a product with digital elements, or has it developed, and places it on the market under its own name, paid or free in the course of a commercial activity.
| Situation | Reporting duty? |
|---|---|
| You sell an app or software that customers install | Yes, you are the manufacturer |
| You sell a device with software, such as a smart thermostat or a till | Yes |
| You commission software and sell it under your brand | Yes, you are the manufacturer, not your developer |
| Your product went on sale in 2023 | Yes, reporting also covers products placed before 11 December 2027 |
| You only offer a web service, with no product delivered | Usually not: pure SaaS falls under other rules such as NIS2, unless it is the remote processing behind a product |
| You use software inside your own company | No, users do not report |
| Free and open-source software outside a commercial activity | No |
Which CSIRT you report to
You report to the CSIRT of the member state of your main establishment: where decisions on the cybersecurity of your products are mainly taken, otherwise where you employ the most people in the EU. A manufacturer without an EU establishment follows a fixed order: the member state of its authorised representative, then of its importer, then of its distributor, and finally where most of its users are. For a US company without an EU representative that sells through a German importer, that means the German CSIRT. Once you have reported somewhere under that last rule, you can keep using the same CSIRT.
Ready for the next exploited vulnerability
- Name who decides that a vulnerability is actively exploited, and who files the report.
- Register on ENISA's Single Reporting Platform before you need it.
- Keep a list of components and versions in your product, so you know when a public vulnerability hits you.
- Draft a user notice in advance, in the languages of your customers.
- Agree with your developers who can act within 24 hours across time zones and weekends.
What counts as a severe incident
Not every bug is reportable. The duty covers a vulnerability in your product that is being actively exploited, and an incident affecting your product's security that is severe. Severe means it harms, or can harm, the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or it introduced or can introduce malicious code into your product or your users' systems. A flaw you find and fix before anyone abuses it is outside the mandatory duty; you may still report it voluntarily, as you may report a near miss.
What missing the clock costs
Breaching the reporting duty can cost up to EUR 15 million or 2.5 percent of worldwide annual turnover, whichever is higher. Micro and small enterprises are not fined for missing only the 24-hour early warning; the 72-hour notification, the final report and informing users still apply to them. If you do not tell your users in time, the CSIRT may do it for you. On top of that comes civil liability: under the new Product Liability Directive, a missing security update counts as a defect for products placed on the market after 9 December 2026.
What your software needs in order to report
Reporting within 24 hours only works if your software tells you what is happening: an activity log of who signed in or changed what, alerts on unusual activity, two-factor authentication for admins, a list of components and versions, and a way to roll out an update fast. That is not an extra project; it is how a web application should be built. If you commission the work, write those requirements and the incident roles into your software requirements. Running WordPress? Read is WordPress safe and have website maintenance done by whoever follows the updates. If you supply NIS2 entities, expect the same questions; see the NIS2 Belgium deadline.
What comes on top from December 2027
- Secure by designNo known exploitable vulnerabilities at delivery, secure default settings.
- Security updatesThroughout the support period, free of charge and separate from new features where possible.
- DocumentationTechnical documentation, an EU declaration of conformity and information for users.
- CE markingProducts with digital elements carry it, after the assessment that fits their class.