“When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I.”Parlamentul European și Consiliul Uniunii Europene · Regulamentul (UE) 2024/2847 privind cerințe orizontale de securitate cibernetică pentru produsele cu elemente digitale · 2024 · Regulamentul (UE) 2024/2847 (actul privind reziliența cibernetică), art. 13 alin. (1) — obligațiile fabricantului
From 11 September 2026, the 24-hour clock starts the moment the manufacturer learns of an actively exploited vulnerability.
Regulation (EU) 2024/2847, the cyber resilience act for short, moves liability onto the manufacturer: the product must be designed, developed and produced against the essential requirements of Part I of Annex I, and the risk is assessed and documented across the whole support period. In practice that means shipping with no known exploitable vulnerabilities, secure default configuration, security updates and a software bill of materials covering top-level dependencies. The calendar is tiered. The reporting duties of Article 14 apply from 11 September 2026: an actively exploited vulnerability is announced by an early warning within 24 hours, a notification within 72 hours and a final report within 14 days. The rest of the regulation applies from 11 December 2027. For anyone who already holds a certified system, the secure development controls of Annex A, 8.25-8.28, from the secure life cycle to secure coding, are exactly where to start.
The card says when the clock starts. The next step is what happens within those 24 hours, before anything is certain. The early warning does not require a full analysis, only the signal that a vulnerability is being actively exploited and that your product is affected. This changes the order of work: first you notify, then you investigate. A classic security process waits for a complete diagnosis before communicating; here, communication comes first. Think of a connected fridge or a home security camera: if the manufacturer learns on a Monday that someone is exploiting it, the clock has already started. So the practical question is not "do we have a procedure?" but "can we send a correct warning overnight?". And that depends on who in the company can decide without waiting for the boss the next morning.
Passage 1 stopped at who can decide overnight. Passage 2 looks at what comes after: the 72-hour notification and the final report. The early warning only says "something is happening". The 72-hour notification must bring the first facts: what is affected, how it is exploited, who is touched. So the firm needs a ready-made channel to the security authority, not one found under pressure. Think of a pizza chain: if you do not know in advance whom to call, the order loses its most expensive time anyway. And the final report, at 14 days, closes the story with what was caused and what was fixed. That means investigation, communication and remediation must run in parallel, not in sequence. The natural next question: who actually receives these notifications, and what do they do with them?
Passage 2 asked who receives the notifications. The answer is designed as a filter, not a queue: the manufacturer sends to a designated contact point, and the information reaches the European incident response network and the market surveillance authorities. The point is not only to know who got hit, but to see the whole picture. If several manufacturers report the same vulnerability in a shared component, the problem reveals itself as systemic. Think of a building where several neighbours report the same leak: separately, each looks like an accident; together, they point to a broken main pipe. For the manufacturer, this means reporting is not an isolated compliance act, but one piece of a Union-wide early warning system. The next question: what happens when the vulnerability is not yours, but a supplier's from your component list?
Why it matters The 24-hour deadline is not negotiated during the incident: either a vulnerability handling process exists that can meet it, or it does not.