On 11 September 2026, the first binding piece of the European Union's Cyber Resilience Act started applying. Article 14 of Regulation (EU) 2024/2847 requires anyone who puts a connected product on the EU market to report an actively exploited vulnerability to ENISA and their national incident-response team within 24 hours of becoming aware of it. A month in, that covers everything from a home IP camera to a programmable logic controller running a factory line.
The timing catches people off guard. The CRA was adopted in October 2024 and entered into force on 10 December 2024, but most of its design-phase cybersecurity requirements don't bite until 11 December 2027. The reporting duty arrived fifteen months ahead of the rest. Companies that budgeted for a 2027 compliance project now carry a live legal obligation they may not have staffed for.
That gap is the story. The penalty exposure is real, up to €15 million or 2.5% of worldwide annual turnover, whichever is higher, and it applies to products already in the field.
What the clock actually measures
The obligation has two triggers. The first is an actively exploited vulnerability, defined in the regulation as one where there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission. The second is a severe incident affecting the manufacturer's development, production or maintenance processes in a way that raises risk for users.
The deadline chain runs in three stages, and the last one is where most compliance checklists go wrong.
Manufacturers file an early warning within 24 hours of awareness. That first filing can be thin: an exploited vulnerability exists, and here are the member states the product is sold in. No root cause analysis is required at that stage.
The full notification lands within 72 hours and covers the general nature of the vulnerability, an initial assessment, and any corrective measures taken or available.
The final report is the trap. For vulnerabilities, the 14-day clock does not start at discovery. It starts when a corrective or mitigating measure becomes available. A team that sets a reminder for "day 14 from awareness" will either file an empty report against a deadline that hasn't begun, or miss the genuine one if the patch ships late.
"A reasonable degree of certainty"
Every deadline hangs off the same word: awareness. The European Commission addressed it in non-binding application guidance published on 27 July 2026, document C(2026) 5252, roughly 80 pages long.
According to that guidance, the clock does not start when a raw bug report or a social media post first reaches a team's desk. It starts once, after a prompt initial assessment, the manufacturer has "a reasonable degree of certainty" that the vulnerability is actually being exploited.
That is a narrow but real triage window. It is not a licence to sit on a report for a fortnight while engineering confirms, and it is not an automatic trigger at the first unverified claim online. The word doing the work in that sentence is "prompt."
The practical consequence is uncomfortable. The moment of awareness is a legal fact, and it is the manufacturer's own determination. Log it, with a timestamp and the evidence behind it. A company that cannot reconstruct when it became certain will have trouble defending its 24-hour filing afterwards.
The tool for filing isn't finished
Reports go through ENISA's Single Reporting Platform, a single electronic entry point meant to reach ENISA and the designated coordinating national CSIRT simultaneously.
Reporting from ComplexDiscovery in September 2026, relayed by the Italian trade outlet intnews.it, found that days before the obligation took effect the platform had no published web address and no submission API at launch. ENISA's own technical guidance acknowledges that the platform's 72-hour counter can display a report as overdue before 72 hours have actually elapsed since awareness.
So the legal duty exists from day one while the plumbing is still being assembled. That is not a reason to delay internal preparation. It is a reason to keep an independent internal record of when awareness was established instead of trusting a countdown rendered by somebody else's software.
Legacy hardware is in scope
This is the detail that has drawn the most attention. Article 14 applies to products placed on the EU market before the CRA existed. Under the Article 69(3) derogation, the reporting obligations apply to all products with digital elements falling within the regulation's scope, including those already on the market before 11 December 2027.
A manufacturer that stopped actively developing a 2021 IP camera but still supports units installed at client sites has to report an exploited vulnerability found in it. The regulation draws no line between CRA-compliant and legacy products. It draws a line between products still in use and supported, and products that have been discontinued.
For camera installers and building integrators that carries direct commercial weight. A vendor's support commitments are now a compliance input rather than a service-level detail, and a two-line warranty extension on an eight-year-old model has a filing obligation attached to it.
Factory floors get a narrower exemption than people expect
The framing of the CRA as a consumer smart-home rule has stuck, and it undersells the industrial exposure. Annex III of the regulation lists industrial automation and control systems, including PLCs, SCADA systems and computerised numeric controllers for machine tools, in the same Important Class I tier as IP cameras, smart locks, baby monitors and alarm systems.
The regulation does allow exceptions to automatic updating in critical industrial environments, because an unprompted patch can halt a production line mid-cycle. That carve-out applies to the update mechanism. It does not touch the 24-hour reporting duty.
An automation vendor with a plant running PLCs on a three-shift schedule still owes an early warning to ENISA within a day. How to patch, and when to schedule the maintenance window, is a separate conversation from when to report.
The penalty, and the two narrow passes
Fines for breaching manufacturer obligations, Article 14 included, run up to €15 million or 2.5% of worldwide annual turnover.
There are two cushions. Manufacturers qualifying as microenterprises or small enterprises are not fined for missing the 24-hour early-warning deadline. Open-source software stewards are not subject to infringement fines under the regulation at all.
What neither cushion settles is where the line on "prompt" falls. That will get answered case by case during enforcement, and there is no case law to read yet.
What comes next
Chapter IV on the notification of conformity assessment bodies applied from 11 June 2026, by which date member states had to designate their notifying authorities. The conformity assessment machinery that sits in front of a CE mark is still being stood up.
The main obligations land on 11 December 2027: a cybersecurity risk assessment in the design phase, the essential requirements of Annex I, technical documentation kept available to market surveillance authorities, an EU declaration of conformity, and a support-period end date printed in the user instructions. Products placed on the market before that date escape those requirements unless they are substantially modified afterwards. The reporting duty has no such grandfathering.
The next real test is whether the first wave of filings actually reaches ENISA through a working channel. There is time before December 2027 to publish the submission API and reconcile the counter. If that work slips, the first enforcement action under Article 14 will land on an unfinished foundation, and the companies that filed on time will be the ones arguing with a platform that marked them late.
More on connected devices and the rules shaping them is in our IoT desk coverage, with earlier pieces in the archive. The full text of the regulation is on EUR-Lex, and the Commission keeps its summary of the Cyber Resilience Act updated as deadlines approach.