EU device makers face 24-hour alert clock

Since 11 September, any company selling a connected device or commercial software in the EU under its own brand has had 24 hours to alert authorities once it learns attackers are exploiting a flaw in it, and the duty covers products already on the market, including units sold long ago (Regulation, European Commission). A company's knowledge of an attack can now reach cyber authorities across the EU within a day. An alert to officials, though, does not put a fix on anyone's device.

The reporting duty is the first part of the Cyber Resilience Act, the EU's product-security law, to take effect. Its rules on how products must be designed apply only from 11 December 2027 (ENISA).

What starts the clock

Two kinds of event trigger a report. The first is an actively exploited vulnerability, meaning reliable evidence that someone has used a flaw maliciously without the owner's permission. The second is a severe incident affecting the product's security, even with no proven flaw. A researcher privately flagging a bug with no sign of attack triggers nothing, according to guidance from the Dutch national cybersecurity centre (Dutch NCSC).

The countdown begins when the manufacturer becomes aware of the problem. It does not start when attackers first struck, and it does not wait for a patch. An early warning is due within 24 hours, and a fuller notification within 72 hours, counted from that same moment rather than from the first filing (ENISA FAQ).

A final report comes later. Its deadline depends on whether the trigger was an exploited flaw or an incident. The manufacturer must also tell affected users how to protect themselves (Regulation).

Where the alert goes

Every filing goes through the Single Reporting Platform, run by ENISA, the EU's cybersecurity agency. The manufacturer addresses its report to the CSIRT in the country of its main EU base. A CSIRT is the national cyber-emergency team that receives incident alerts. That team passes the report to its counterparts in every country where the product is sold (ENISA).

Reports are not published. Some will describe flaws that have no fix yet. In exceptional cases, the coordinating team can therefore hold back onward sharing, but the manufacturer's deadlines still apply (Regulation). The provision addresses a plain risk: details of an unpatched weakness grow more dangerous as they spread.

Who has to be ready

A "manufacturer" is whoever sells the product under its own name. Headquarters and company size make no difference. The definition catches a German machine builder's remote-maintenance controller and an Irish firm's commercial app, even one that is free to download (Silicon Republic).

Most of the burden is operational. Someone with authority to file must be able to spot an attack, judge it and submit a report on a Sunday night. On 11 September, Germany's electrical engineering association VDE urged producers to build those detection and escalation processes (VDE).

French coverage just before launch found that submissions were manual, with no interface for automated filing (ZDNet France). Each report therefore depends on a person being available when the clock starts.

Firms that miss the deadlines answer to national market-surveillance authorities. These are the regulators that can investigate whether products comply and fine firms that do not. Penalties can reach €15 million or 2.5% of worldwide turnover (Regulation). The launch announcements explain the process, but they include no count of filings (ENISA, European Commission).

Europe now has a single channel for a manufacturer's knowledge of an attack. It sends that knowledge to the national cyber teams of every country where the product is sold, including older products still in use. That channel speeds up what officials learn. Users are protected only when a working patch reaches their device.

ENISA and the Commission can show whether faster alerts lead to faster fixes. They would need to publish two figures: how many reports arrive, and how long users wait before a patch reaches them.