24-hour Reporting Deadline Under The EU Cyber Resilience Act Now In Effect

Key takeaways

Scope: If you make connected PDEs, including hardware, software, or firmware products that reaches the EU market, you may be a PDE manufacturer. An EU entity is not required.

Two triggers: Reportable events include an actively exploited vulnerability in your product or a severe incident affecting the product’s security. Both run from the moment you become aware.

Fast deadlines: Early warning in 24 hours. Fuller notification in 72 hours. Final report in 14 days after a fix is available (or one month after the 72-hour filing for severe incidents).

Parallel obligations: The Single Reporting Platform (SRP) of the European Union Agency for Cybersecurity (ENISA) delivers to your Computer Security Incident Response Team (CSIRT) designated as coordinator (CDaC) and ENISA at once. Separately, you must tell “impacted users” (and in certain circumstances, all users).