Europe’s 24-hour vulnerability clock reports to regulators first and customers second

The week

The EU Cyber Resilience Act entered into force in December 2024, and most of its obligations apply from December 11, 2027. Its reporting duty came first. From September 11, 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents affecting their products. The sequence is an early warning within 24 hours of becoming aware, a fuller notification within 72 hours and a final report later. Reports go through ENISA’s Single Reporting Platform to the national CSIRT acting as coordinator, with ENISA informed at the same time. ENISA launched an initial version of the platform on September 11 and said it would add functions over the following months. The duty covers products already on the market, not only new ones. Medical devices regulated under the EU device regulations are outside the Act.

Most commentary on the Cyber Resilience Act addresses manufacturers. Banks, health systems and public agencies mostly sit on the other side, as buyers of the operating systems, network equipment, security tools, applications and connected devices the Act covers. For them, the useful question is how news of an exploited flaw in something they run will now reach them. The answer runs through three separate channels: the regulator channel the Act built, the customer channel it requires but does not time, and the buyer’s own channel for everything the Act leaves out. Each needs a different response. Organizations should check with counsel whether any of their own activities make them a manufacturer under the Act.

The regulator channel

The 24-hour clock runs from the manufacturer to the authorities. An early warning goes to the coordinating CSIRT in the member state of the manufacturer’s main establishment, and ENISA sees it at the same time. A fuller notification follows within 72 hours. For a vulnerability, the final report is due within 14 days of a fix or mitigation becoming available. For a severe incident, it is due within a month of the notification. The Act lets information arrive in stages, so an early warning can be thin.

For buyers, this channel matters indirectly. Authorities can now see which manufacturers report quickly and which report late, and they can share information with CSIRTs in other member states where the product is sold. Over time that should push vendors toward faster triage. Buyers do not, however, receive these reports. A bank’s security team cannot log in to the ENISA platform and read what its firewall vendor filed. What the regulator channel changes is vendor incentive, and buyers should not mistake it for an alert feed.

It also changes the internal maturity a vendor needs. Meeting a 24-hour clock requires knowing which products and versions contain an exploited component. That means a current component inventory, which the Act will require more formally, through a software bill of materials, from December 2027. Vendors without that inventory face the reporting clock first and the documentation duty later.

The customer channel

The Act also requires manufacturers to inform impacted users of an actively exploited vulnerability or a severe incident, and where appropriate all users. Where relevant, they must describe mitigation or corrective measures users can take. The duty is real, and it covers products placed on the market before the main obligations apply. It does not carry the same hour-by-hour deadline as the report to authorities.

That gap is where contracts earn their keep. A buyer can ask that customer notice follow the regulator notice within a short, defined period, and that it name affected products and versions. It can also specify that notice go to a monitored security mailbox rather than a sales contact. The Act also encourages notice in a structured, machine-readable format where appropriate. A buyer that can ingest such advisories into its vulnerability management tool will act faster than one that reads emails. CSAF, the common advisory format many large vendors already publish, is the obvious target.

Notices are only useful if they can be matched to assets. Here is a simple test. When a vendor names an affected version, the security team should be able to list every place it runs within an hour. For many organizations the honest answer depends on whether the configuration management database is current for network appliances and on-premises software. Fixing that is cheaper than any contract clause.

The buyer’s own channel

The Act leaves large parts of a regulated organization’s estate untouched. Software delivered purely as a service is generally addressed by other EU law, notably NIS2, unless it is remote processing integral to a product. Medical devices sit under their own regulations. Software an organization builds for its own use is not placed on the market. Open-source components pulled directly into in-house code carry lighter or no obligations, depending on who stewards them.

For these, nothing changed on September 11. A hospital still learns of a flaw in an infusion pump through the device maker and health-sector channels. A bank still relies on its SaaS providers’ contractual incident terms. An agency still tracks exploited vulnerabilities in its own code through its own scanning and through public sources such as CISA’s Known Exploited Vulnerabilities catalog.

The practical step is to label every critical technology asset by channel. Assets covered by the Act can be held to its customer notice duty. Assets outside it need equivalent terms written into contracts or monitored through other feeds. The labeling also exposes a common blind spot: products bought through resellers or bundled into managed services, where the buyer may not know which manufacturer owes it notice.

US organizations are part of this picture whether or not they operate in Europe. Most large technology vendors sell into the EU and will run one global process rather than a European one. Their disclosure habits will shift for every customer, even if only European users have the legal right to notice.

With hindsight

Writing in October 2026, the regime has run for about a month, too short to judge its effect. ENISA’s platform went live on schedule, in an initial version that the agency says it will extend over the coming months, with user manuals, a glossary and a help desk alongside. The channel split described here has held. Buyers see the customer notices, not the regulator filings. No public data yet show how many reports have been filed or how quickly. The December 2027 obligations, including component documentation, will raise the bar further. Organizations should follow Commission and ENISA guidance as it develops, and confirm with counsel how the Act applies to products they sell.