EU Cyber Resilience Act mandates 24-hour vulnerability reporting by 2026

The European Union is imposing aggressive transparency requirements on the digital supply chain through the Cyber Resilience Act (CRA). Starting September 11, 2026, manufacturers of products with digital elements sold within the EU must adhere to strict mandatory reporting timelines for security failures.

Under Article 14 of the Act, companies must provide an "early warning" to the European Union Agency for Cybersecurity (ENISA) within 24 hours of becoming aware of an actively exploited vulnerability or a severe security incident. This initial alert must be followed by a comprehensive, detailed notification within 72 hours. These deadlines apply regardless of a manufacturer's internal validation process, triggering the moment awareness occurs.

The Compliance Gap

This reporting mandate is part of a broader EU strategy to secure the Internet of Things (IoT) and digital ecosystems, working alongside the AI Act and the NIS2 Directive. A cornerstone of the CRA is the requirement for manufacturers to maintain technical documentation, including a Software Bill of Materials (SBOM), to help identify affected components during a disclosure. While reporting obligations trigger in 2026, the full suite of engineering requirements—including essential security standards and CE marking—will not be fully applicable until December 11, 2027.

Industry Implications

The 24-hour window creates a significant operational hurdle for vendors. The burden shifts from technical analysis to organizational routing, requiring companies to determine exactly what software was shipped and when the organization first became aware of a flaw. For many, this is a visibility problem rather than a security one. As Abby Kearns, CEO of ActiveState, noted, for the duration of the current implementation runway, the CRA functions primarily as a visibility requirement.

This urgency stands in stark contrast to current industry norms. According to an Edgescan 2026 report, the average time to remediate a high or critical application vulnerability is approximately 55 days. The gap between the 24-hour legal reporting requirement and the 55-day remediation average highlights the pressure vendors face to manage public and regulatory expectations while developing a technical fix.

What to Watch

Vendors failing to comply with these timelines face significant legal and financial penalties. The primary challenge for the industry over the next two years will be moving away from manual tracking and stale SBOMs toward real-time supply chain visibility. Market observers will be watching to see how ENISA manages the influx of early warnings and whether the EU provides further guidance on what constitutes "awareness" of an exploit to avoid premature or inaccurate reporting.