Under the EU's 2024 Cyber Resilience Act, vulnerability reporting has begun and full rules follow in 2027

The European Union's Cyber Resilience Act, Regulation (EU) 2024/2847, entered into force on December 10, 2024. It is the first EU law to set mandatory cybersecurity requirements for products with digital elements, the hardware and software on the EU market, from baby monitors and smartwatches to apps and computer programs. Its rules arrive in stages. Since September 11, 2026, manufacturers have had to report actively exploited vulnerabilities and severe incidents affecting their products, and the main obligations apply from December 11, 2027.

Which products it covers

The act applies to hardware and software products and their remote data processing solutions, including components such as chips and operating systems that are sold separately. A product is in scope when it is made available on the EU market in the course of a commercial activity, paid or free, and its intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. Products that are not supplied commercially fall outside it, as do some products already covered by other EU laws.

Free and open-source software is covered only when it is made available on the market, and software that its makers do not monetize does not count as a commercial activity. Developers who contribute code to projects they are not responsible for are not covered. The act creates a lighter regime for open-source software stewards, organizations that support such software for commercial use on a sustained basis. They need a cybersecurity policy, must cooperate with market surveillance authorities and, from December 11, 2027, must report actively exploited vulnerabilities and severe incidents, but they are not subject to administrative fines under the act.

What manufacturers will have to do

Manufacturers carry the main obligations. They must assess cybersecurity risks and take them into account from planning and design through production, delivery and maintenance, check that third-party components do not undermine security, and record all this in technical documentation. The Commission gives examples of what designing a product to be secure from the start involves: security by default, so no more “password” as a default password, access control, cryptography and automatic updates.

Before a product goes on sale, the manufacturer runs a conformity assessment, draws up an EU declaration of conformity and affixes the CE marking. It must also set a support period, during which it handles the product's vulnerabilities, and state its end date, including the month and year, at the time of purchase. The support period must be at least five years, unless the product is expected to be in use for less time. Importers and distributors must check that the products they sell carry the marking, and distributors also that they come with this information.

How strict the assessment is depends on the product, according to the Commission:

• Default products, such as memory chips, mobile apps, smart speakers and computer games: the manufacturer may assess itself.
• Important products, such as operating systems, antivirus software, routers and firewalls: a notified body must take part in some cases, especially when the manufacturer has not applied harmonized standards.
• Critical products, such as smart cards, secure elements and smart meter gateways: a notified body must be used, or a European cybersecurity certification scheme where one applies.

The reporting duty that applies now

Since September 11, 2026, a manufacturer that becomes aware of an actively exploited vulnerability or a severe incident affecting the security of its product must send an early warning within 24 hours and a full notification within 72 hours. A final report follows no later than 14 days after a fix or mitigation is available for a vulnerability, and within a month of the 72-hour notification for a severe incident.

Manufacturers report once, through the Single Reporting Platform that the EU cybersecurity agency ENISA has run since September 11. The notification goes to the national computer security incident response team (CSIRT) where the manufacturer has its main establishment, is normally made available to ENISA at the same time, and is passed on to the CSIRTs of the other member states where the product has been made available. The duty covers every product made available on the EU market, including those placed on it before December 11, 2027. Micro and small enterprises cannot be fined for missing the 24-hour deadline, and anyone may report vulnerabilities, threats or incidents voluntarily through the same platform.

What comes next

A product placed on the market before December 11, 2027, falls under the act's main requirements only if it is substantially modified after that date. The Commission's guidance of July 27, 2026, explains what counts as a substantial modification and how support periods apply, with particular attention to microenterprises and small and medium-sized businesses, including 67 practical examples. Penalties for breaches are set at the national level.

Standards are the other piece. The Commission has asked the European standardization organizations for 41 standards, both general and product-specific. Its implementation timeline, last updated in July 2026, put the first deliverables in the third quarter of 2026 and more by October 30, 2027. Products that follow harmonized standards will be presumed to meet the essential requirements, the same mechanism the AI Act uses, as our report on its first harmonized standard explains.