From 11 September, EU law forces manufacturers to report an exploited vulnerability in any connected product, smart toys and wearables included, within 24 hours: the duty already covers products sold years ago, 15 months before the same regulation’s CE-marking deadline

What changes on 11 September

The Cyber Resilience Act is the EU's first horizontal cybersecurity law built around products rather than services: it applies to hardware and software 'products with digital elements' sold into the EU, a category the regulation's own recitals list as covering connected toys, wearables, smart home devices such as door locks and baby monitors, routers, laptops, smartphones and industrial sensors, among many others. It excludes products already regulated elsewhere for cybersecurity, medical devices and in-vitro diagnostics under Regulations (EU) 2017/745 and 2017/746, and motor vehicles under the UNECE-based type-approval regime in Regulation (EU) 2019/2144, along with non-commercial open-source software and products built solely for national defence. Article 14 requires a manufacturer that becomes aware a product in that scope has an actively exploited vulnerability, or has suffered a severe incident affecting its security, to notify the CSIRT designated as coordinator in the EU member state where it has its main establishment, made available to ENISA at the same time unless exceptional circumstances apply. The notification follows a fixed three-step timeline: an early warning within 24 hours flagging the exploitation and, where relevant, its cross-border reach; a fuller vulnerability or incident notification within 72 hours describing severity and any corrective measures taken or available; and a final report within 14 days for a vulnerability, or one month for a severe incident, describing the vulnerability, any exploiting actor and the remedy applied. ENISA's Single Reporting Platform, the shared portal manufacturers use to file all three, is due to be operational the same day the obligation takes effect.

The numbers behind 11 September

One number is how little time a manufacturer gets once a vulnerability is being actively exploited. One is how far the reporting duty sits ahead of the deadline most roadmaps are built around. The third is the ceiling EU law already sets for getting this specific obligation wrong.

The real subject: a 24-hour duty that assumes classification and distribution data most brands have not built yet

Two details in the text turn 11 September from a cybersecurity-team milestone into a compliance-data problem. The first is Article 69(3). The CRA's general transitional rule says a product placed on the market before 11 December 2027 is not retroactively subject to the regulation unless it later undergoes a substantial modification, the framing behind most 'you have until 2027' coverage. Article 69(3) writes Article 14 out of that shelter: the reporting duty applies to a product with digital elements already on the EU market on 11 September 2026, however long it has already been sold, with no exemption for age or for having shipped before the regulation even existed. A brand cannot answer the 24-hour clock for a 2019 baby monitor or a 2021 fitness tracker by pointing to the 2027 date; it has to already know that product is in scope. The second is the CSIRT itself. A manufacturer with no main establishment in the EU, the position of most brands selling into Europe through local subsidiaries, importers or licensees, does not get to pick a CSIRT: Article 14 sets a fixed order, first the member state of its authorised representative for the highest number of its products, then the member state of the importer placing the highest number of its products on the market, then the member state of the distributor doing the same. None of that is data a security team keeps. It is distribution volume, by product line, by EU country, tracked commercially rather than technically, and a brand only discovers which of those three answers applies to a given product line by working it out in advance, because Article 14 gives it 24 hours to file the first notification once a vulnerability is being actively exploited, not 24 hours to first work out where to send it.

Why it matters for brands

The direct exposure sits with any retail, consumer-goods or luxury brand selling a physical product with any network or device connection into the EU: connected toys, wearables, smart home and beauty devices, routers and connected packaging or anti-counterfeiting tags among the categories the regulation's own examples name. Because Article 14 is already in force from 11 September 2026 and, under Article 69(3), already covers products placed on the market years before that date, the practical task is not a 2027 roadmap item; it is three things a compliance team needs answered this week. First, an accurate scope list: which SKUs, current and legacy, meet the 'product with digital elements' definition, since a company-wide assumption is not enough once the duty runs product by product. Second, a classification against Commission Implementing Regulation (EU) 2025/2392's technical descriptions, default, important Class I or II, or critical, because that classification determines which conformity route the product will need by December 2027 and, more immediately, feeds the severity and content a 24-hour notification has to state. Third, for any brand without an EU-based manufacturing entity, a documented answer to which authorised representative, importer or distributor carries the highest volume of each product line, since that is what fixes which national CSIRT the clock runs against. A brand that can produce all three today can file a compliant report within 24 hours of a live exploit. A brand that cannot spends part of that 24 hours discovering its own product and distribution data instead of containing the vulnerability.

Two ways to read 11 September

Frequently asked questions