EU Cyber Resilience Act reporting duties for digital products apply from September 11
As of September 11, 2026, the EU Cyber Resilience Act requires manufacturers of products with digital elements to report actively exploited vulnerabilities and severe security incidents through ENISA's Single Reporting Platform. Early warnings are due within 24 hours of awareness and fuller notifications within 72 hours. Legal IT Insider and Stevens & Bolton flagged the deadline on September 10, 2026.
Text (Legal IT Insider) → · Stevens & Bolton