EU Enforces 24-Hour Cybersecurity Vulnerability Reporting
New EU law mandates rapid vulnerability disclosures for digital products.
1Immediate Vulnerability Reporting
The EU's Cyber Resilience Act now requires manufacturers to report actively exploited vulnerabilities within 24 hours of discovery. This applies to all products with digital elements sold in the EU, regardless of the manufacturer's location. A detailed follow-up report must be submitted within 72 hours, with final reports due in 14 days for vulnerabilities or one month for serious incidents. Non-compliance can result in fines up to €15 million or 2.5% of annual turnover.
2Global Impact
The regulation affects both EU and non-EU manufacturers, who must file reports through ENISA's Single Reporting Platform. EU-based companies report to their member state's CSIRT, while non-EU manufacturers follow specific coordination rules. The law aims to create a unified approach to cybersecurity across borders, ensuring rapid information sharing to mitigate risks. This global reach underscores the EU's leadership in setting digital security standards that may influence other regions.
3User Notification Requirements
Manufacturers must inform affected users about vulnerabilities and available fixes without undue delay. This transparency measure ensures end-users can protect themselves while maintaining trust in digital products. The requirement applies equally to corrections and mitigations, creating accountability throughout the product lifecycle. Such disclosures may reshape how companies communicate security issues, moving from opaque practices to proactive transparency.
4Strict Penalties
Violations of the reporting requirements, classified as core responsibilities under the CRA, may trigger maximum fines. The tiered penalty system escalates to €15 million or 2.5% of global turnover for severe breaches. These substantial fines reflect the regulation's seriousness and aim to deter non-compliance. Legal experts note this creates unprecedented accountability for manufacturers operating in the EU market.
5Future Requirements
By December 2027, manufacturers must implement 'security by design and default,' eliminating default passwords and making updates mandatory. Products will require conformity assessments and CE marking before EU market entry. These upcoming provisions will fundamentally change product development cycles, embedding security as a core requirement rather than an afterthought. The timeline gives companies three years to adapt their processes.
6Supply Chain Transparency
The CRA mandates Software Bill of Materials (SBOM) creation and maintenance throughout product lifecycles. This requirement, effective in 2027, forces manufacturers to map all components including proprietary code, open-source packages, and AI services. Maintaining real-time SBOMs enables rapid vulnerability impact assessments across complex software ecosystems. Experts highlight this as a game-changer for supply chain security.
7Regulatory Overload Concerns
Manufacturers face challenges complying with multiple overlapping EU digital regulations including NIS2, DORA, and the AI Act. Lawyers warn the CRA's broad scope—applying beyond consumer IoT to all digital products—has caught many organizations unprepared. Compliance teams must now navigate intersecting requirements across these frameworks, creating operational complexities for global businesses operating in the EU.
8Long-Term Security Transformation
The CRA represents a fundamental shift toward proactive cybersecurity governance. By enforcing rapid vulnerability disclosure, supply chain transparency, and security-by-design principles, the EU aims to reduce cyberattack frequency and impact. While implementation poses challenges, the regulation could elevate global cybersecurity standards as manufacturers adapt their practices to meet these rigorous requirements.