On Friday at 4.30 p.m., within regular business hours, a customer reports that unknown processes are running on several devices and that data is being exfiltrated. Under the Cyber Resilience Act, a notification on Monday may already be late.
While most CRA obligations take effect on 11 December 2027, manufacturers of products with digital elements have been required to submit notification within 24 hours since 11 September 2026 Infringements can be penalised with fines of up to EUR 15 million or 2.5% of global annual revenue.
It is therefore crucial to determine when the deadline begins. The European Commission's guidance clearly states that the deadline does not begin only after the matter has been fully investigated, but rather as soon as an immediate initial assessment establishes a "sufficient degree of certainty" that a vulnerability in the manufacturer's own product is being exploited.