As of 11 September 2026, manufacturers are subject to strict obligations to report vulnerabilities and incidents under Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) No 2019/1020 and Directive (EU) 2020/1828 (the “Cyber Resilience Act” or the “Regulation”)[1]. This early application constitutes a notable exception, given that, as a general rule, the provisions of the Regulation become applicable from 11 December 2027.
Under the provisions of the Cyber Resilience Act, the reporting obligation laid down in Article 14 focuses on two major risk scenarios:
- Actively exploited vulnerability: Reporting is not triggered by the mere discovery of a weakness, a design flaw or a coding error in the product with digital elements. The manufacturer is required to notify only when it obtains reliable evidence that a malicious actor has exploited the vulnerability in a system without the permission of the system owner.
- Severe incident having an impact on the security of the product with digital elements: Pursuant to Article 14(5) of the Regulation, an incident reaches the severity threshold requiring reporting if it affects (actually or potentially) the essential functions of the product relating to the protection of the availability, authenticity, integrity or confidentiality of data, or if it directly or indirectly facilitates the execution of malicious code. The scenario involving the compromise of the software update channel falls squarely within this legal definition, as it creates a critical risk of distributing malicious code across users’ networks, which is why the reporting obligation is triggered before any customer experiences the effects of the attack.
I. Who is subject to the reporting obligation?
The obligation laid down in Article 14 lies with the manufacturer of the product with digital elements. Pursuant to Article 3, point (13), a manufacturer is a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge.
For example, a company that purchases a mobile application from an external developer and distributes it under its own trademark qualifies as a manufacturer and is directly subject to the reporting obligations, even though it was not directly involved in the development of the application.
An importer or distributor is considered to be a manufacturer, and is subject to the obligations laid down in Article 14 of the Regulation, where it places a product with digital elements on the market under its name or trademark or carries out a substantial modification of a product with digital elements already placed on the market.
II. Which products fall within the scope?
The reporting obligation covers software or hardware products whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.
These include:
- Hardware products and connected devices (IoT): consumer electronics (Smart TVs, smartwatches, fitness trackers, smart speakers), smart household appliances (robot vacuum cleaners, washing machines, refrigerators with Wi-Fi), network equipment (home Wi-Fi routers, switches, IP cameras, video intercoms) and basic hardware components (motherboards, network cards, microcontrollers, HDDs/SSDs).
- Software products: everyday applications (messaging applications, mobile banking applications, e-mail clients), professional software (database systems, CRM or ERP applications, editing software requiring an internet connection), security solutions (antivirus/anti-malware software, VPNs) and video games (PC, console, mobile) that feature an online multiplayer component.
Pursuant to Article 2(2)–(7), the Regulation does not apply to certain products subject to specific sectoral regulatory regimes, such as medical devices (e.g., smart insulin pumps, pacemakers with remote monitoring capabilities, MRI or CT scanners, and diagnostic medical software), type-approved vehicles (e.g., passenger cars, including their complex navigation and autonomous driving systems), civil aviation and maritime equipment (e.g., aircraft onboard computers, radar navigation systems for ships, heavy-duty utility drones subject to a special flight regime), certain spare parts, as well as products developed or modified exclusively for national security or defence purposes (e.g., encrypted communication systems intended exclusively for military use or analytical software developed strictly for intelligence services), or products specifically designed to process classified information.
III. What happens to products already placed on the market?
The vulnerability and incident reporting obligations apply to all products with digital elements falling within the scope of the Regulation that were placed on the market before 11 December 2027. With regard to the obligations laid down in Article 14, the Regulation does not distinguish between products that have undergone substantial modifications and products that have remained unchanged since they were placed on the market. Accordingly, a manufacturer that places a product on the European Union market must take into account the obligations laid down in Article 14 of the Regulation, irrespective of whether or not the product is subsequently modified.
IV. What are the reporting deadlines?
Reporting takes place in three stages, subject to the conditions and deadlines laid down in Article 14(2) in the case of actively exploited vulnerabilities and the conditions and deadlines laid down in Article 14(4) in the case of severe incidents. The reports corresponding to the second and third stages are no longer required to the extent that the relevant information has already been provided at the first stage.
1. Early warning notification – within 24 hours of the manufacturer becoming aware
- Actively exploited vulnerability: the manufacturer shall submit, without undue delay and in any event within 24 hours of becoming aware of the vulnerability, an early warning notification and shall indicate, where applicable, the Member States in which it is aware that the affected product has been made available;
- Severe incident: the manufacturer shall submit, without undue delay and in any event within 24 hours of becoming aware of the incident, an early warning notification indicating at least whether the incident is suspected of being caused by unlawful or malicious acts and, where applicable, the Member States in which it is aware that the affected product has been made available;
2. Vulnerability or incident notification – within 72 hours of the manufacturer becoming aware
- Actively exploited vulnerability: the manufacturer shall submit, without undue delay and in any event within 72 hours of becoming aware of the vulnerability, a vulnerability notification containing general information about the affected product, the general nature of the exploit and of the vulnerability concerned, the corrective or mitigating measures already taken and those that users can take and, where applicable, shall indicate how sensitive it considers the notified information to be;
- Severe incident: the manufacturer shall submit, without undue delay and in any event within 72 hours of becoming aware of the incident, an incident notification containing the available information regarding the nature of the incident and an initial assessment thereof, as well as the corrective or mitigating measures taken and those that users can take. Where applicable, the manufacturer shall also indicate how sensitive it considers the notified information to be;
3. Final report
- Actively exploited vulnerability: the manufacturer shall submit the final report no later than 14 days after a corrective or mitigating measure becomes available. This may occur before the vulnerability notification (i.e. before expiry of the 72-hour deadline established for submitting the notification itself) or at a later point in time. The report must describe the vulnerability, including its severity and impact, include, where available, information concerning the malicious actor that has exploited or is exploiting the vulnerability, and provide details of the security update or other corrective measures made available to remedy the vulnerability;
- Severe incident: the manufacturer shall submit the final report within one month of submitting the notification made within the 72-hour period following the time it became aware of the incident. The report must include a detailed description of the incident, including its severity and impact, the type of threat or root cause likely to have triggered the incident, as well as the mitigation measures applied and those ongoing.
Between these stages, the manufacturer may be requested to provide an intermediate report on relevant status updates, both in the case of actively exploited vulnerabilities and in the case of severe incidents.
V. The starting point of the deadlines
The deadlines for the first two stages run from the point at which the manufacturer ‘becomes aware’ of the event. According to the European Commission Guidelines[2], this moment does not mean the first warning signal, but rather the completion of the initial assessment through which a reasonable degree of certainty is obtained regarding the existence of the incident or the active exploitation of the vulnerability.
Extending the investigation in order to obtain absolute confirmation does not justify delaying the notification and exceeding the 24-hour deadline. In practice, manufacturers are advised to rigorously document internally the exact date and time at which they completed this initial assessment.
VI. To whom and through which channel are the notifications submitted?
Notifications corresponding to the three stages of reporting – the early warning, the vulnerability or incident notification and the final report – are submitted through the single reporting platform established pursuant to Article 16, operated by the European Union Agency for Cybersecurity (“ENISA”), which has been operational since 11 September 2026.[3] Notifications are submitted using the electronic notification end-point of the national computer security incident response team designated as coordinator (“CSIRT”) in the Member State where the manufacturer has its main establishment in the European Union and are simultaneously accessible to ENISA.
The competent CSIRT is that of the Member State where the manufacturer has its main establishment in the European Union, more specifically the Member State where decisions related to the cybersecurity of its products with digital elements are predominantly taken. If such a Member State cannot be determined, the main establishment is considered to be in the Member State where the manufacturer concerned has the establishment with the highest number of employees in the European Union.
For manufacturers that do not have an establishment in the European Union, Article 14(7) establishes the following order of criteria for determining the relevant Member State:
- the Member State in which the authorised representative acting on behalf of the manufacturer for the highest number of products with digital elements of that manufacturer is established;
- the Member State in which the importer placing on the market the highest number of products with digital elements of that manufacturer is established;
- the Member State in which the distributor making available on the market the highest number of products with digital elements of that manufacturer is established;
- the Member State in which the highest number of users of products with digital elements of that manufacturer are located.
For manufacturers whose main establishment is in Romania, the CSIRT designated as coordinator is the National Cyber Security Directorate (“DNSC”).
VII. Informing users
In addition to notifying the authorities, Article 14(8) requires the manufacturer to inform the impacted users and, where appropriate, all users of the vulnerability or incident and of the measures they can deploy to mitigate the impact of the respective vulnerability or incident, where appropriate, in a structured and machine-readable format. Where the manufacturer fails to inform users in a timely manner, the CSIRT may itself provide the information to users where this is considered proportionate and necessary for preventing or mitigating the impact of the respective incident or vulnerability.
VIII. Penalties under the Regulation
Article 64 places infringements of the reporting obligations at the highest threshold under the Regulation: administrative fines of up to EUR 15,000,000 (approximately RON 78,955,000) or, in the case of undertakings, up to 2.5% of their total worldwide annual turnover for the preceding financial year, whichever is higher.
By way of derogation, manufacturers that qualify as microenterprises or small enterprises are not subject to administrative fines for failure to comply with the 24-hour deadline applicable to the early warning notification. The exception concerns exclusively the failure to meet this deadline and does not remove the reporting obligation or liability for non-compliance with the other obligations laid down in the Regulation
———————
[1] Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) No 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act) is available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847.
[2] European Commission Guidelines on the application of the Regulation, point 213, available at: https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation.
[3]The single reporting platform operated by ENISA is available at: https://portal.cra-srp.enisa.europa.eu/.
