The Cyber Resilience Act clock doesn’t stop for weekends
EU Cyber Resilience Act reporting duties require manufacturers to track all product versions still in use.
The EU Cyber Resilience Act's reporting duties, which began in September 2026, require manufacturers to maintain a register of every product version still in use, even those no longer sold. Companies must define 'awareness' of an exploited flaw and ensure a designated person can file a 24-hour early warning report on any day of the year, including weekends. Failure to comply can result in fines of up to €15 million or 2.5% of turnover.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Copla?
Get an email when a new story names Copla, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe EU Cyber Resilience Act (CRA) introduced mandatory 24-hour early warning reporting for actively exploited vulnerabilities, effective September 2026, with no exemptions for weekends or holidays. Many manufacturers are unprepared because they lack both the operational processes to detect 'awareness' of exploitation in real time and designated personnel available around the clock to file reports. Additionally, maintaining a version register for every product still in use—even discontinued ones—adds a significant ongoing inventory burden that most companies have not planned for. Non-compliance risks fines of up to €15 million or 2.5% of global turnover, making this a material business risk, not just a procedural one. Organizations that treat regulatory deadlines as a future problem rather than a present operational requirement will find themselves exposed when an incident occurs on a Saturday night.