Manufacturers selling into the EU now owe ENISA a 24-hour warning on exploited flaws

Covered manufacturers must send an early warning to the European Union Agency for Cybersecurity (ENISA) and the relevant national Computer Security Incident Response Team within 24 hours.

The Cyber Resilience Act entered into force earlier, and most of it does not legally apply until December 2027, but that is no longer true of the framework's reporting obligations.

As of September 11, 2026, manufacturers of products with digital elements sold into the EU market have to report actively exploited vulnerabilities and severe incidents.

Lee says the CRA covers anything digital sold in the EU, from baby monitors to smart watches, applications, connectable hardware and software, and that compliant products will have the CE marking.

Earlier in the summer, the European Commission "published practical guidance to help manufacturers, developers, and businesses of all sizes meet their obligations under the Cyber Resilience Act."

The European Commission's Cyber Resilience Act guidance is 84 pages.

Neither the Sysdig nor the SC World account states a penalty or enforcement consequence for missing the 24-hour early warning.

The CRA's reporting obligations are in force for 15 months before the rest of the regulation applies.

GDPR Article 33 requires regulated entities to notify the supervisory authority without undue delay and no later than 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms; under Article 34, individuals are notified too if the risk to them is high.

NIS2 Article 23 requires a 24-hour early warning after becoming aware of a significant incident, a fuller notification at 72 hours, and a final report at one month.

DORA requires an initial notification within four hours of classifying an incident as major, and in no case later than 24 hours from becoming aware of it, followed by an intermediate report at 72 hours and a final report at one month.

SEC Form 8-K Item 1.05 requires organizations to disclose a material cybersecurity incident within four business days of determining it is material.

Sysdig lists six regulatory regimes with very similar but not identical deadlines, recipients and forms, and says a single incident at a multinational financial institution that ships software and has US listings can plausibly trigger four of them at once.

In the DORA and SEC family the clock starts with a judgment the organisation makes: DORA's four hours begin when the incident is classified as major and the SEC's four business days begin when the incident is determined material, and neither clock starts at incident discovery.

Lee wrote: "Start getting processes, reporting, etc. setup now, it'll be December 11th 2027 before you know it."

Among the six regimes listed, counting initial notifications only, no deadline falls due sooner than the CRA's 24 hours except DORA's four hours, which begin at classification rather than awareness.

The CRA is one of the six regimes listed, so five others carry their own clocks.

For a software vendor selling into highly regulated industries, its notification is the event that also starts its customers' clocks.

CISA is expected to finalize CIRCIA in September 2026, and once enacted it is expected to mandate reporting of a covered cyber incident within 72 hours of reasonably believing one occurred, and a ransom payment within 24 hours of disbursing it.