Law and legal tech, in three minutesGet the 7 a.m. briefDaily Brief PodcastMenu
EURegulation

EU Cyber Resilience Act reporting duties for digital products apply from September 11

By LexCircuit Desk · · AI-drafted, human-reviewed

As of September 11, 2026, the EU Cyber Resilience Act requires manufacturers of products with digital elements to report actively exploited vulnerabilities and severe security incidents through ENISA's Single Reporting Platform. Early warnings are due within 24 hours of awareness and fuller notifications within 72 hours. Legal IT Insider and Stevens & Bolton flagged the deadline on September 10, 2026.

Text (Legal IT Insider) → · Stevens & Bolton

Key points

  • Article 14 reporting duties apply from September 11, 2026 for manufacturers of in-scope products with digital elements.Legal IT InsiderStevens & Bolton
  • Manufacturers must file an early warning within 24 hours of awareness and a full notification within 72 hours.Legal IT InsiderStevens & Bolton
  • Final vulnerability reports are due within 14 days after a fix; severe-incident finals within one month of the 72-hour report.Stevens & Bolton
  • Filings go through ENISA's Single Reporting Platform to the relevant CSIRT and, ordinarily, to ENISA.Legal IT InsiderStevens & Bolton
  • Legal IT Insider said the Act covers vendors in the EU and those selling digital products into the EU.Legal IT Insider
  • Stevens & Bolton said non-compliance fines can reach €15 million or 2.5% of global annual turnover.Stevens & Bolton

Sources2 articles across 2 outlets · 4 in the cluster

Related

Filed under

RegulationEUEU Cyber Resilience ActComplianceData protectionRegulatoryTechnologyFor practitionersFor governanceFor vendors