Skip to Content

Manufacturers must now report exploited flaws in their products within 24 hours

The reporting obligations of the Cyber Resilience Act (Regulation (EU) 2024/2847) apply from September 11, 2026, and ENISA's single reporting platform has been operational since that day.
September 11, 2026
Curated Maximum

What it says

  • Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents that affect the security of their products.
  • Deadlines: early warning within 24 hours of becoming aware, full notification within 72 hours, and a final report no later than 14 days after a corrective measure is available, for vulnerabilities, or one month after the 72-hour notification, for incidents.
  • Reporting is done once, on ENISA's single reporting platform (SRP), which forwards it to the national CSIRT of the country of the main establishment and to ENISA itself.
  • Open-source software stewards will have reporting obligations from December 11, 2027.

ENISA single reporting platform (SRP): www.enisa.europa.eu

The Tech Guardian summarizes and comments in its own words on third-party publications. The full information belongs to the original source, which we recommend you read.

Our take

If you manufacture or market under your own brand a product with software, whether a connected device or an application, a 24-hour clock is already running. That requires knowing who receives vulnerability alerts, who decides whether there is exploitation and who has access to the ENISA platform. Rehearse the process with a simulated case before the first real one arrives.

A cyberattack halts Boston Scientific's manufacturing and shipments and sinks its forecasts
Boston Scientific told the SEC, in an 8-K dated September 7, that the cyberattack detected on August 25 will likely have a material impact on its results.