The EU's 24-hour vulnerability clock started on 11 September

In brief

Since 11 September, manufacturers of hardware and software sold in the European Union have had to report actively exploited vulnerabilities and severe security incidents on a fixed clock. They must send an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days for a vulnerability or one month for an incident. The Cyber Resilience Act's reporting duty covers products already on the market, not only new ones, and it binds manufacturers wherever they are based.

A day later, on 12 September, the Data Act's "access by design" duty began for connected products newly placed on the EU market. Together they turn two things into operational obligations with dates attached: product security response and customer access to device data. Most organisations run the first as a best-effort process and have not built the second.

What the Cyber Resilience Act now requires

Article 14 of the act applies to "products with digital elements" made available on the EU market. That covers connected hardware and software alike.

• The clock. An early warning goes in within 24 hours of the manufacturer becoming aware of an actively exploited vulnerability or a severe incident. A fuller notification follows within 72 hours. The final report is due within 14 days for a vulnerability and one month for a severe incident.
• The route. Reports go through ENISA's Single Reporting Platform to the relevant national computer security incident response team, with ENISA seeing them at the same time.
• The scope. Products already sold are included. A router, controller or application shipped years ago and still on the market is covered.
• The penalty. Law-firm guidance puts maximum fines for breaching the reporting duties at €15 million or 2.5% of worldwide annual turnover, whichever is higher.

The law firm Faegre Drinker calls the timetable "a much more aggressive timetable than most US businesses will have in place". For comparison, US federal agencies now have three days to patch actively exploited flaws in the products they run. The CRA gives the makers of those products one day to tell regulators such a flaw is being exploited.

What the Data Act added on 12 September

From 12 September, connected products and related services placed on the EU market must be designed so that the data they generate is, by default, "easily and securely accessible, free of charge, in a format that is comprehensive, structured, commonly used, and machine-readable". Access must be direct where that is technically feasible, and buyers must be told before purchase what data the product collects and how to get it. Micro and small enterprises are exempt. Products placed on the market before 12 September escape the design duty but remain subject to the rules on providing data when users ask for it.

Why it is harder than it looks

The clock starts at awareness, not certainty. Twenty-four hours is less time than most organisations take to confirm that exploitation is real, find which products and versions are affected, and get legal approval to say anything. The early warning is meant to be early. It has to go before those answers are complete.

Old products are the hard part. Many manufacturers do not have a reliable list of which versions of which products are still on the EU market, or which third-party and open-source components are inside them. An actively exploited flaw in a component is a flaw in every product that ships it.

September showed how fast this happens. In the month the obligation began, attackers exploited network appliances within days of a fix and in one case two months before one existed, and a web platform within hours of disclosure. ByteNib's account of September's exploited edge appliances shows the pattern the 24-hour warning is designed to capture. For manufacturers, those are now reporting events as well as engineering ones.

Decisions to make now

1. Name one owner for the clock. Give a single function, usually the product security incident response team, the authority to file the early warning without a committee meeting. Agree in advance what legal review looks like on a 24-hour timetable.
2. Know what you have on the EU market. Build or fix the inventory of products, versions and components currently available in the EU, including older products still sold or supported.
3. Decide how you will find out. Monitor the sources that reveal active exploitation of your products and their components: CISA's catalogue of exploited vulnerabilities, component vendors' advisories, threat intelligence and customer reports. The clock runs from when you become aware, so how you become aware matters.
4. Prepare before the first incident. Register on ENISA's reporting platform and draft templates for the 24-hour, 72-hour and final reports, so that the first real filing is not also the first rehearsal.
5. Rehearse with a real case. Run a tabletop exercise on a September-style scenario, an exploited flaw in a product you shipped two years ago, and time it.
6. Check new connected products against the Data Act. For anything placed on the EU market since 12 September, confirm with product and legal teams that user data access was designed in, and that the pre-purchase disclosures exist.

Sources and scope

The reporting obligations, timelines and scope are from Faegre Drinker, Hogan Lovells, Crowell & Moring and the European Commission's reporting page. The fine levels are from law-firm guidance, including Freshfields, and should be checked against the regulation's text for your case. The Data Act duty is from Faegre Drinker and Wilson Sonsini.

This article is ByteNib editorial analysis, not legal advice. Whether a product is in scope, and what counts as awareness or a severe incident, depends on the regulation's detailed definitions and on guidance that is still developing.

Continue exploring: IT Leadership analysis, the related implementation tutorial, and the structured learning path.