Cyber Resilience Act

If you ship software, a 24 hour reporting clock has applied since 11 September 2026

Most of the Act applies from December 2027. The reporting duty applied fifteen months earlier, and it also covers everything already in customers' hands.

By Oscar CobbeCurrent as at 29 September 20269 minute read5 sources

The date that matters is September, not December

Regulation (EU) 2024/2847, the Cyber Resilience Act, entered into force on 10 December 2024. Article 71 then staggers it across three dates.

The essential requirements, conformity assessment and CE marking do arrive on 11 December 2027. That is the date worth planning a product roadmap around. It is not the date that creates your first legal obligation.

Article 14, the reporting duty, has applied since 11 September 2026. Since that morning, if attackers have exploited a security flaw in a product you make (an actively exploited vulnerability), you have to report it within 24 hours. The report goes to your coordinating CSIRT, which in Ireland is the National Cyber Security Centre, and to ENISA, the EU's cyber security agency.

What	Applies from	Article
The notified body framework	11 June 2026	Chapter IV
Reporting exploited vulnerabilities and severe incidents	11 September 2026	Article 14
Essential requirements, conformity assessment, CE marking	11 December 2027	Article 71

It applies to what you have already shipped

Article 69(2) exempts products placed on the market before 11 December 2027 from the product requirements. Article 69(3) then expressly says the reporting duty is not part of that exemption. Every version already in a customer's hands has been in scope since 11 September 2026, whatever it was built against, including versions you no longer sell.

Whether it reaches you

The scope test can go either way, so work through it.

Article 2(1) covers products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. Article 3(1) defines that as a software or hardware product and its remote data processing solutions.

Recital 12 puts standalone cloud services outside it: cloud services designed and developed outside the responsibility of a manufacturer of a product with digital elements do not fall within scope. A recital of Regulation (EU) 2025/327, the European Health Data Space Regulation, later says the same thing: the Act does not cover Software as a Service directly as such.

If everything you run lives on your servers and your customer only ever opens a browser, the Cyber Resilience Act does not apply to you. NIS2 may well apply, if you are medium sized or larger, but that is a different set of duties with a different regulator.

Then Article 3(2) brings a backend (the servers you run that your product relies on) back in. It defines remote data processing as data processing at a distance for which the software is designed and developed by the manufacturer, or under its responsibility, and the absence of which would prevent the product from performing one of its functions. Recital 11 gives the example outright: a mobile application requiring access to an API or a database provided by a service the manufacturer developed.

In practice, if you ship a mobile app, a desktop client, a browser extension, an on-premise agent, firmware or a separately distributed library, you are in. The backend that app depends on comes in with you, even though the same backend on its own would have been outside.

There is no small company exemption

Article 2 contains no turnover threshold and no headcount exemption. A four-person company in Galway shipping a desktop application is a manufacturer under this Regulation, as a multinational is.

Smaller manufacturers get some relief, but only on paperwork, fees and the fine for one filing.

1Article 33(5) allows micro and small enterprises to provide simplified technical documentation.
2Article 32(6) provides for a reduction in conformity assessment fees.
3Under Article 64(10)(a), microenterprises and small enterprises cannot be fined for missing the 24 hour deadline for the early warning. That relief covers that one filing only. The 72 hour notification and the final report carry no such relief.

The carve-out is one filing, not the duty

Article 64(10)(a) does not excuse small companies from reporting. It means a microenterprise or small enterprise cannot be fined for missing the 24 hour early warning specifically. The obligation to file it still exists, and everything after it is enforceable in the normal way.

What the clocks are

There are two clocks, and they differ. Both have run since 11 September 2026, and both require three filings. The final report is counted from a different point in each.

Article 3(42) defines an actively exploited vulnerability as one for which there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission. A flaw you found in your own review does not count unless there is reliable evidence that an attacker has exploited it. Under Article 14(5) an incident is severe where it affects, or could affect, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or where it has led, or could lead, to malicious code running in the product or in a user's systems.

Filings go to the coordinating CSIRT and to ENISA at the same time, through the single reporting platform. ENISA opened the platform on 11 September 2026. In Ireland the coordinating CSIRT is the National Cyber Security Centre.

Article 14(8) adds a duty to your users. Once you are aware of an actively exploited vulnerability or a severe incident, you must inform the users affected, and where appropriate all users. You must also tell them of any measures they can take to reduce the impact.

Stage	Exploited vulnerability	Severe incident
Early warning	24 hours from becoming aware	24 hours, saying whether it looks malicious
Notification	72 hours, with what it is and what has been done	72 hours
Final report	14 days after a fix is available	One month from the notification

What the duty needs from you

What applies now is Article 14: reporting, and telling users. It needs somebody who knows the clock has started, a way of finding out that a vulnerability is being exploited, a filing route set up before it is needed, and a way of reaching your users.

1Establish whether you are in scope at all. If you ship nothing and your customers only use a browser, you are outside the Act and the rest of this does not apply to you.
2Write down which of your products are in scope, including versions you no longer sell. Article 69(3) reaches those too.
3Name the person who owns the 24 hour clock, and a deputy.
4Find the single reporting platform and read ENISA's user guide before you need it. The NCSC says no pre-registration is required: the account is created at the first submission.
5Have a way of learning that something of yours is being exploited: a monitored security contact address at minimum, and a route for a researcher to reach a human.
6Know how you would reach your users, all of them if need be, with a notice and the measures they can take.

This is scoping, not a security audit

The first question is whether the Act applies to you at all. If it does not, that answer is worth having in writing.

Sources

Five questions, and the free check says whether it reaches you

The free Cyber Resilience Act check runs the scope test in the same order as the Regulation. It tells you which duties follow and which article each one comes from, and it prints as a document you can hand to a board or a customer. Your answers stay in this browser tab unless you ask us to email them, and you do not need an account.

Run the free check

Who wrote this

Oscar Cobbe · Founder, FourWinds Digital

Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and each article shows the date it was last checked.

More about how we work →