Europe's New Cyber Reporting Clock Starts Ticking Before You Have the Full Picture

From that date, makers of digital products sold in the EU must report actively exploited vulnerabilities and serious security incidents affecting product safety.

Companies that fail to fix internal responsibilities and reporting channels before the first alarms arrive risk blowing deadlines and facing stiff penalties.

Three clocks, one platform Statutory reporting deadlines run from the moment of awareness.

Software makers, connected IoT device producers, industrial machinery manufacturers and networking equipment suppliers are among those covered.

The rest of the Cyber Resilience Act — including essential security requirements, CE marking and the declaration of conformity — only applies from 11 December 2027.