The European Union has activated key provisions of the Cyber Resilience Act, imposing strict cybersecurity reporting obligations on digital product manufacturers and software developers. Companies must now report exploited vulnerabilities to the European Union Agency for Cybersecurity (ENISA) within 24 hours, followed by a detailed report within 72 hours.
Once a vulnerability is patched, developers have 14 days to submit a final report. For major cybersecurity incidents, the deadline for the final report is extended to one month. These rules apply not only to new products but also to existing hardware and software currently available on the EU market, regardless of whether the company is based in Europe or abroad.
The regulation covers a wide range of sectors, including software developers, hardware manufacturers, and IoT device suppliers. To facilitate compliance, the European Commission has issued guidance documents and launched a centralized reporting platform managed by ENISA to standardize the process and reduce administrative burdens for companies.
While the vulnerability reporting requirements are effective immediately, full compliance with the Cyber Resilience Act—including product certification, technical documentation, and CE marking—will become mandatory by December 2027. This phased implementation aims to improve transparency and response times across the digital ecosystem.
