New reporting obligations under the EU Cyber Resilience Act took effect on 11th September 2026, creating short notification deadlines for manufacturers of products containing digital elements.
Manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of their products. The requirements cover hardware and software made available in the EU, including products already on the market.
An early warning must generally be submitted within 24 hours after the manufacturer becomes aware of the vulnerability or incident. A fuller notification must follow within 72 hours through the single reporting platform operated by the EU Agency for Cybersecurity.
For an actively exploited vulnerability, the manufacturer must provide a final report no later than 14 days after a corrective or mitigating measure becomes available. For a severe incident, the final report is due within one month of the 72-hour notification.
The report is initially directed to the Computer Security Incident Response Team in the Member State where the manufacturer has its main establishment. Information will ordinarily also be made available to the European Union Agency for Cybersecurity (ENISA) and shared with relevant teams in other Member States where the product has been supplied.
Although most of the Cyber Resilience Act’s substantive product security requirements will not apply until December 2027, manufacturers cannot wait until then to establish their reporting arrangements. The present duties require organisations to identify affected products, detect relevant events and reach reportability decisions within demanding timescales.
UK manufacturers and software developers are within scope where their products are made available on the EU market. They should identify which corporate entity is the manufacturer for each product, determine who has access to the necessary technical information and allocate authority for submitting notifications.
The new process should also be coordinated with existing incident-reporting obligations. The same event may require consideration under the UK GDPR or EU GDPR, NIS2, contractual notification provisions and sector-specific regulatory regimes, but the relevant thresholds, recipients and deadlines will not necessarily be identical.
For more information, see our Cybersecurity for Data Protection Professionals training course.
