Europe's 24-Hour Hack Reporting Rule Is Now Live — 15 Months Before the Rest of the CRA

Since 11 September 2026, manufacturers selling products with digital elements in the EU must file an early warning within 24 hours of learning that a vulnerability is being actively exploited, and a full notification within 72 hours, through ENISA's new Single Reporting Platform. The rest of the Cyber Resilience Act — CE marking, conformity assessment, support periods — only applies from December 2027, and fines reach €15 million or 2.5% of global turnover.

Key Takeaways

Since 11 September 2026, manufacturers selling products with digital elements in the EU must file an early warning within 24 hours of learning that a vulnerability is being actively exploited, and a full notification within 72 hours, through ENISA's new Single Reporting Platform.
The rest of the Cyber Resilience Act — CE marking, conformity assessment, support periods — only applies from December 2027, and fines reach €15 million or 2.5% of global turnover.

AI synthesis3 sources9

Since 11 September 2026, manufacturers of products with digital elements sold in the European Union have been legally required to report hacked software — and to do it fast.

The Cyber Resilience Act's first hard deadline is now live. Under Article 14, manufacturers must file an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident affecting their product's security, followed by a full notification within 72 hours. A final report is due no later than 14 days after a corrective measure becomes available for an exploited vulnerability, or within one month of the 72-hour notification for a severe incident.

Notifications run through a single channel: the CRA Single Reporting Platform built by ENISA, which became operational on 11 September. A manufacturer files once; the platform routes the report to the CSIRT of the member state where it has its main establishment and, unless exceptional circumstances apply, shares it simultaneously with ENISA and with CSIRTs in other countries where the product has been made available.

The obligations cover hardware and software placed on the EU market. Manufacturers are the primary duty-holders, with separate obligations for importers and distributors. Open-source software stewards get a later start: their reporting duties under Article 24(3) begin on 11 December 2027.

That is also when the bulk of the regulation lands. Conformity assessment, CE marking, technical documentation, vulnerability-handling processes and security support periods apply from 11 December 2027 — 15 months after the reporting clock started. Penalties for breaching the regulation reach up to €15 million or 2.5 percent of total worldwide annual turnover.

The practical difficulty is speed. Law firms advising manufacturers note that the timelines are measured in hours rather than days, which forces companies to decide quickly whether an event is reportable at all and to have escalation paths and technical monitoring in place beforehand. DLA Piper's privacy team calls the requirements "an early priority for organisations preparing for compliance" and warns that areas of regulatory uncertainty remain.