European Union Implements Strict Reporting Requirements for Cyber Vulnerabilities
Manufacturers of connected products in the European Union (EU) are now facing a significant shift in their operational responsibilities, as a new legal obligation will come into effect on September 11, 2025. This requirement mandates that manufacturers must report actively exploited vulnerabilities to national authorities within a strict timeframe of 24 hours upon confirmation. This deadline precedes the full application of the Cyber Resilience Act (CRA), set for December 11, 2027, and represents the act’s first enforceable requirement.
The CRA encompasses a wide range of products with digital elements that are placed on the EU market. This includes enterprise software, consumer Internet of Things (IoT) devices, industrial controllers, and component software. It establishes a standardized protocol for improving cybersecurity and resilience within digital and technological products across the union.
As stipulated in Article 14 of the CRA, manufacturers are required to initiate an early warning system within 24 hours of becoming aware of any vulnerability that is actively being exploited or in the event of a significant security incident. This initial notification must be followed by a more comprehensive report within 72 hours. Ultimately, a final report detailing the corrective measures implemented must be submitted within 14 days, with an extended window of one month permitted for severe incidents.
These reports will be collected through a single reporting platform managed by the European Union Agency for Cybersecurity (ENISA). This platform is designed to facilitate streamlined communication across member states. Manufacturers will need to file a single report to a designated national Computer Security Incident Response Team (CSIRT), which will subsequently relay the information to other CSIRTs and ENISA in real-time. The European Commission has confirmed that the platform will be operational by the September deadline, having undergone rigorous functional and security testing.
However, this new obligation does not come without its challenges. The criteria for awareness of a security incident present notable difficulties for manufacturers. The standard for triggering a report mandates a reasonable degree of certainty that a product’s security has been compromised or that exploitation is currently underway. This judgment must be made relatively quickly, often based on potentially incomplete telemetry data. Furthermore, manufacturers are not allowed to delay their reporting obligation by choosing to forego investigation into a potential issue.
Additional complexities arise from the nature of compliance. Unlike other requirements under the CRA, manufacturers are bound by these reporting duties even after their products have reached the end of their lifecycle. This stipulation places ongoing pressure on companies to maintain vigilance and compliance regarding products that are no longer actively marketed. Additionally, importers and distributors who substantially modify or rebrand a product assume the full range of obligations originally held by the manufacturer, which could create challenges for supply chain management.
The potential penalties for failing to meet these core obligations are severe, with fines reaching up to €15 million or 2.5% of the company’s global annual turnover—whichever amount is higher. Industry experts have identified two major gaps in readiness as the deadline approaches. First, the reporting platform is set to launch concurrently with the deadline, leaving manufacturers with no opportunity to conduct practice submissions. Second, standardized guidelines defining what constitutes adequate compliance remain under public review, compelling companies to develop processes in response to ever-evolving requirements.
The repercussions of this legislation extend beyond the manufacturers themselves. Enterprises that acquire connected products must now adapt to receiving vulnerability notifications according to the vendor’s timeline rather than their own. This necessitates a shift in how organizations handle supplier advisories, requiring modifications to incident triage processes. Companies will also need to determine if the same cyber event triggers separate reporting duties under other legislative frameworks, such as NIS2 or DORA.
To illustrate the importance of this legislation, consider the recent confirmation from Adobe regarding a critical vulnerability in their Magento platform (CVE-2026-75650), which has been actively exploited since September 4. Had the exploitation been detected just a week later, it would have triggered the 24-hour reporting window established by the CRA, highlighting the new reality that organizations must now navigate.
As the enforcement date approaches and stakeholders make final preparations, the implications of the Cyber Resilience Act will likely reverberate throughout the cybersecurity landscape, prompting increased diligence and strategic shifts to ensure compliance with these rigorous new standards.
Source: The Cyber Express