The EU Cyber Resilience Act’s 24-hour reporting rule: is it actually realistic?

On 11 September 2026, a new clock started running for any manufacturer selling a “product with digital elements” into the EU.

Under Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847), if one of their products is being actively exploited, they now have 24 hours to send an early warning to ENISA and national CSIRTs. A detailed notification follows within 72 hours, then a final report, including root cause analysis, within 14 days of a patch becoming available.

ENISA’s Single Reporting Platform, the only channel the CRA recognises for these filings, went live on the same day.

This obligation arrives 15 months ahead of the rest of the CRA. Secure-by-design requirements, conformity assessment, and CE marking don’t apply until 11 December 2027. Article 14 was deliberately pulled forward, and it now covers every product currently on the market, not just new ones released after the deadline.

Does this apply in the UK?

It depends on what you sell, not where you’re based. If a UK business places a product with digital elements on the EU market, an app, a connected device, custom software, anything digital that reaches EU customers, the CRA applies directly, including the Article 14 reporting duties this article covers. Being established outside the EU doesn’t exempt you. What matters is whether the product ends up on the EU market.

If a business trades only within the UK, the CRA has no jurisdiction, but there’s no domestic equivalent filling that gap. The Product Security and Telecommunications Infrastructure Act, in force since April 2024, sets baseline requirements for consumer connectable products, things like banning default passwords and requiring a vulnerability disclosure policy, but it has nothing resembling the CRA’s tiered incident reporting. The Cyber Security and Resilience Bill, introduced in November 2025, updates the UK’s NIS framework for operators of essential services. That’s closer to NIS2’s territory than the CRA’s, and it doesn’t create product cybersecurity obligations either.

For most UK SMEs, the practical exposure isn’t the reporting duty itself. It’s the vendors. The MDM platform, the line-of-business software, and the connected hardware a business depends on are increasingly likely to come from a manufacturer who does sell into the EU and is now on the clock this article describes.

What’s actually at stake

The CRA backs this up with real money. Failing to meet the essential cybersecurity requirements, or the obligations in Articles 13 and 14, carries fines of up to €15 million or 2.5% of a company’s global annual turnover, whichever is higher.

Secondary obligations sit at a lower tier: up to €10 million or 2% of turnover. Giving authorities false, incomplete, or misleading information carries its own penalty, up to €5 million or 1% of turnover, which matters given how much pressure a 24-hour deadline puts on accuracy.

There’s one carve-out worth knowing. Microenterprises and small enterprises are exempt specifically from fines for missing the 24-hour and 72-hour deadlines in Article 14. They still have to report, and they’re still liable for other CRA breaches, but the EU built in some slack for smaller manufacturers on the timing itself.

The first week was a live test

The regulation didn’t have to wait long to be tested. On 3 September, a week before Article 14 took effect, Google confirmed active exploitation of CVE-2026-85046, a type confusion flaw in Chrome’s V8 engine.

On 8 September, Chrome 153 shipped with 230 security fixes, and Google flagged a second actively exploited flaw, CVE-2026-87491, in the same release. The next day, Volexity reported that threat actors tracked as UTA0560 and JungleBamboo had been chaining Chrome and Windows zero-days together in campaigns running since 1 September.

That is precisely the kind of week Article 14 exists for: multiple live exploits, overlapping timelines, and vendors needing to decide fast what to tell authorities and when.

This isn’t a new idea (it’s an extension of one)

The CRA’s three-stage structure, early warning, detailed notification, final report, isn’t a new invention. NIS2’s Article 23 already requires almost the same cadence from essential and important entities: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month of that notification. NIS2 has been in force since October 2024. What the CRA does is extend a similar reporting rhythm from operators of critical services to the manufacturers of the products those services, and everyone else, run on.

The precedent for hour-scale reporting goes back further still. GDPR’s Article 33 has required a 72-hour breach notification to supervisory authorities since 2018. The direction of travel across EU digital law has been consistently the same for eight years: shorter windows, earlier disclosure, more parties on the hook.

What the 24 hours is actually for

The detail that gets lost in most coverage is that the 24-hour deadline doesn’t require a finished investigation. ENISA’s guidance is explicit that the early warning only needs to confirm a product is affected and share what’s already known, not a confirmed root cause, not a finalised scope, not a fix.

That work is pushed to the 72-hour and 14-day stages, once there’s been time to do it. NIS2 draws the same distinction for its own early warning stage: it exists to let authorities start coordinating, not to deliver a verdict.

What this means if you don’t build software

Most Dr Logic clients aren’t manufacturers under the CRA’s definition, so the reporting obligation itself doesn’t fall on them directly. But two things could be at play regardless: First, if any part of the business sells a digital product, an app, a connected device, custom software, it’s worth confirming whether that puts you in scope, since the microenterprise exemption only covers the reporting deadlines, not the underlying duty to report.

Secondly, and more relevant for most SMEs, is exposure through vendors. The MDM platform, the line-of-business software, and the connected hardware a business runs are all now covered by a legal floor on how fast their maker has to disclose an active exploit. That’s a concrete question worth adding to supplier due diligence, not a hypothetical one.

Is it realistic?

Yes, and the CRA’s own text is why.

Fifteen months separate the reporting obligation from full compliance because the EU built time into the harder parts of this regulation while pulling the reporting clock forward on its own. The 24-hour bar is a warning, not a verdict, matching a pattern NIS2 and GDPR have already normalised across EU law for years. The genuine risk isn’t that the deadline is unreasonable, but rather that a lot of manufacturers, going by how new the ENISA platform still is, haven’t built the internal process to hit it yet.

If you’re not sure where your business sits in all this, whether it’s your own products, the vendors you rely on, or just wanting an incident response plan that would actually hold up under a 24-hour clock, get in touch and we’ll walk through it with you.