CLAIM-2026-08-24-06

Under the Cyber Resilience Act, Regulation (EU) 2024/2847, the Article 14 reporting obligations apply from 11 September 2026: a manufacturer that becomes aware of an actively exploited vulnerability in its product must send an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days of a corrective measure, to the coordinating CSIRT and ENISA via the Single Reporting Platform.

Why it matters

Twenty-four hours is a detection-and-inventory deadline, not an investigation window; it only works if 'which of our products contains this component' is already answerable.

Sources

• europeancom2026cra
• crowellmori2026eu