EU Cyber Resilience Act to Enforce New Reporting Requirements

How Will Companies Adapt to the 24-Hour Reporting Window

Starting Friday, businesses operating in the European Union will be required to report cybersecurity incidents to national authorities within 24 hours of becoming aware of them. This new obligation stems from the EU Cyber Resilience Act, which aims to strengthen digital security across member states by ensuring timely disclosure of threats. The rule applies to manufacturers, importers, and distributors of digital products, ranging from software to connected devices. Failure to comply could result in significant fines under the regulation’s enforcement framework.

The Cyber Resilience Act introduces a unified approach to cybersecurity risk management for products with digital elements sold in the EU. It mandates that companies assess vulnerabilities throughout a product’s lifecycle and report exploitable flaws promptly. Authorities argue that rapid reporting enables faster coordination of responses, reducing the window for cyberattacks to spread. The regulation also requires importers to verify that non-EU manufacturers comply with EU security standards before placing products on the market. National cybersecurity agencies will oversee implementation and monitor adherence through audits and incident tracking.

What Happens if a Company Misses the Deadline

Businesses are now reviewing internal incident response plans to meet the tight deadline, with many investing in automated monitoring tools and staff training. Industry groups note that while the goal of transparency is supported, the short timeframe poses challenges for complex supply chains where determining the origin and scope of a breach can take time. Some companies have begun conducting regular breach simulations to improve readiness. Experts suggest that clear internal communication chains and predefined reporting protocols will be essential to avoid penalties and maintain compliance.

Failure to report a cybersecurity incident within 24 hours may lead to administrative fines, though the exact amount depends on the severity of the violation and the member state’s national legislation. Penalties could reach up to 2% of global annual turnover or 10 million euros, whichever is higher, under the Act’s tiered sanction model. Regulators emphasize that intent and cooperation during investigations will influence enforcement decisions. Over time, consistent non-compliance could trigger stricter scrutiny or market restrictions on non-conforming products.

What types of incidents must be reported under the new rule? Businesses must report any cybersecurity vulnerability that is actively exploited or could reasonably lead to a breach, including flaws in software, hardware, or firmware that affect product security.

Frequently Asked Questions

Who is responsible for reporting — the manufacturer or the importer? Both parties share responsibility; manufacturers must report flaws in their products, while importers must ensure foreign-made goods meet EU standards and report issues they identify after distribution.

Will small businesses face the same requirements as large corporations? Yes, the regulation applies to all economic operators placing digital products on the EU market, although guidance and support resources are being developed to assist smaller entities in meeting obligations.