EU Launches Mandatory 24-Hour Cybersecurity Vulnerability Reporting Under Cyber Resilience Act
Under Article 14 of the European Union's landmark Cyber Resilience Act (CRA), a new mandatory reporting regime went live on September 11, 2026, compelling manufacturers of connected hardware and software products to report actively exploited vulnerabilities and severe security incidents within 24 hours of discovery.
To facilitate compliance, the European Union Agency for Cybersecurity (ENISA) launched the Single Reporting Platform (SRP), an integrated portal that allows companies to submit a single notification that is automatically routed to national Computer Security Incident Response Teams (CSIRTs) across all EU member states. Manufacturers must submit an initial early warning within 24 hours, followed by a detailed assessment within 72 hours, and a final technical report within 14 days of releasing a security patch.
The mandate applies broadly to any product with digital elements sold in the EU market, spanning industrial controllers, smart home gadgets, operating systems, and connected automotive components. While full compliance requirements—including CE cybersecurity marking—will take effect in December 2027, the immediate activation of the reporting framework aims to prevent automated, AI-driven cyberattacks and supply-chain compromises by rapidly sharing threat intelligence across European cybersecurity networks.
