EU Cyber Resilience Act imposes 24‑hour breach reporting from September 2026

From 11 September 2026 the EU Cyber Resilience Act (CRA) introduces mandatory reporting obligations for manufacturers of products with digital elements placed on the EU market. Companies must submit an early‑warning notice within 24 hours of learning of an actively exploited vulnerability or a serious security incident, sending it to ENISA and the relevant national CSIRT (in Germany, CERT‑Bund). A detailed follow‑up report is required within 72 hours, and a final remediation report within 14 days after a fix is deployed.

Non‑compliance can attract fines of up to €15 million or 2.5 % of worldwide annual turnover, whichever is higher. Analyses show many firms lack clear responsibility chains, comprehensive product inventories, integrated monitoring tools, and realistic response times, creating gaps in meeting the tight deadlines. The CRA therefore demands a fully functional, documented process that can identify the affected product, assess the risk, decide on reporting, and submit the required notifications even under time pressure.