The same incident, three reports and three different clocks

The Cyber Resilience Act — Regulation (EU) 2024/2847 of the European Parliament and of the Council, in force since 10 December 2024 — is almost always presented as a 2027 deadline. That is correct for CE marking, essential cybersecurity requirements and technical documentation: they apply from 11 December 2027. But the Regulation does not start all at once. The first block that directly affects businesses arrives now: the reporting obligations in Article 14 apply from 11 September 2026. They do not concern only future products. They concern products you have already sold.

What starts on 11 September, and which products it covers

The duty rests with the manufacturer of products with digital elements, and the category is broader than the word might suggest: it includes software sold in its own right, not only physical objects containing software. It also includes anyone who places a product on the market under their own name or trade mark, whom the Regulation treats as a manufacturer in every respect. If you resell under your own brand a component made by someone else, the reporting duty is yours, not the original maker’s.

Two kinds of event must be reported, and they must be kept separate because their triggers differ: an actively exploited vulnerability contained in the product, and a severe incident having an impact on the security of the product itself. The report is made once, through the single reporting platform managed by ENISA, and addressed to the CSIRT of the Member State where the manufacturer has its main establishment. From there, the information reaches ENISA and the other CSIRTs concerned.

There are three deadlines. They run from the moment the event becomes known, not from the moment it is understood:

• Early warning, within 24 hours. It is enough to report that something has happened. You do not need to understand what yet.
• Notification, within 72 hours. A description of the event, to the extent known at that stage.
• Final report. Fourteen days for an actively exploited vulnerability; one month for a severe incident.

The point that changes the calculation is the scope: the reporting obligations also apply to products placed on the market before 11 December 2027. There is therefore no division of the kind many businesses have in mind between an old installed base to be run down and a new line to be made compliant. If a product you sold in 2022 is still in circulation and someone exploits a vulnerability in it, the clock starts all the same.

One event, three clocks starting together

Almost every business I encounter has an incident-management procedure. Almost all wrote it around the GDPR, because the GDPR came first. The result is a procedure triggered when personal data is involved and built around a 72-hour deadline. The Cyber Resilience Act requires neither.

The three regimes do not exclude one another: they can apply cumulatively to the same facts. Defective firmware in a device that does not process personal data triggers only the Cyber Resilience Act. The same firmware in a device that collects customer data may trigger all three, with three different recipients and the first deadline at 24 hours. A business with a single procedure set to 72 hours is already two days late by the time it opens that procedure.

Who decides that a vulnerability is “actively exploited”

There is an unspoken premise behind all this: to report within 24 hours, you must know within 24 hours. The reporting duty therefore presupposes something many businesses do not have: a channel for receiving external reports — from clients, researchers and component suppliers — and someone who reads them in time.

Classification is the delicate step. Deciding that a vulnerability is actively exploited, rather than merely known, is not a purely technical assessment: it starts a statutory deadline and opens a potential liability. Where the decision is left to the individual technician who receives the email, with no written criteria and no one to whom it can be escalated, there is no prudent choice. There is only chance.

It must be said that the meaning of “actively exploited” leaves genuine room for judgement, and there is no enforcement practice yet: the Regulation applies on this point from 11 September. At this stage, the defensible choice is not the narrowest or the broadest one, but the documented one: who decided, when, and on the basis of what information.

What needs to be in place

Four things, in order of urgency. None requires months.

1. A single event-management procedure built around the shortest clock — 24 hours — with the three routes towards the CSIRT, the Italian Data Protection Authority and clients decided in advance, not when they are needed.
2. A list of the products you have placed on the market and that remain in circulation, including the versions you support and those you no longer support. Without it, you do not know the extent of your duty.
3. Upstream clauses for third-party software component suppliers: who notifies whom, within how many hours, and with what consequences if they fail to do so. Your 24-hour period does not become longer because the supplier notified you late. It is the same kind of problem discussed in the note on the documents clients are starting to request.
4. A decision log: each classification, with its date, author and reasons. A year later, it is the only thing that proves an assessment was made.

None of these four items is a project: they are a document, a list, a clause and a record. Producing them now costs a week’s work. Producing them on the day the first report arrives costs an order of magnitude more, and the price is paid before an authority that has already been counting the hours.