EU cyber resilience rules force 24-hour flaw disclosure

Active Exploitation Triggers Immediate Reporting Duty

Manufacturers selling digital products in the European Union must now report active vulnerabilities within 24 hours. This new obligation stems from the Cyber Resilience Act. Companies are required to notify cybersecurity authorities about severe security incidents. The specific reporting duties outlined in Article 14 of the regulation became fully applicable on this date. These rules target firms that place connected devices on the EU market. They must act quickly when known flaws are being actively exploited by attackers.

The regulation aims to tighten security standards for hardware and software sold across Europe. Manufacturers can no longer wait for a convenient time to address critical bugs. If a product has a digital element, it falls under these strict timelines. The law mandates immediate communication with relevant national authorities. This ensures that patches and mitigations reach users before widespread damage occurs. The focus is on preventing large-scale breaches caused by unpatched systems.

How Does This Change Daily Operations?

The core requirement centers on actively exploitedvulnerabilities. This means a flaw is not just theoretical but currently being used by threat actors. Once a manufacturer confirms such an attack, the 24-hour clock starts ticking. They must submit a detailed report to the designated national cybersecurity authority. The report must include technical details about the flaw and the affected product versions. This rapid response mechanism is designed to coordinate defenses across borders. It allows other companies to check their own supply chains for similar weaknesses.

This shift fundamentally alters how companies handle post-launch maintenance. Previously, many firms treated security updates as routine background tasks. Now, severe incidents demand urgent attention and structured documentation. Manufacturers must maintain clear processes to detect and verify active exploits. They need dedicated teams ready to draft reports under pressure. The regulation also covers severe security incidents, not just code bugs. This includes cases where a product’s design leads to unexpected data leaks or system failures. Compliance requires continuous monitoring rather than one-time checks.

The immediate consequence is a higher operational burden on mid-sized firms. Large corporations may absorb these costs easily, but smaller players face tighter margins. They must invest in better tooling and staffing to meet deadlines. Failure to report on time could lead to penalties or market restrictions. Looking ahead, this framework sets a precedent for global digital product safety. Other regions may adopt similar rapid-disclosure models. For now, EU buyers gain faster protection against known threats. The era of silent patching is officially over.

Frequently Asked Questions

Who must report vulnerabilities under the new rule? Any manufacturer placing a product with digital elements on the EU market must comply. This includes both hardware makers and software developers. Exemptions exist for certain categories, but most commercial goods are covered.

What counts as an actively exploited vulnerability? It refers to a security flaw currently being used by attackers in the wild. The manufacturer must have evidence or strong indication that the bug is under active use. Merely finding a bug in a code audit does not trigger the 24-hour deadline.