The EU's Cyber Resilience Act gives you 24 hours to report an exploited flaw

When the clock starts

The 24-hour rule works like the moment you notice your bank card is missing. The clock doesn't start when you feel ready to call the bank. It starts when you realise the card is gone.

Under the Cyber Resilience Act, manufacturers of products with digital elements must submit an early warning to ENISA and the coordinating Computer Security Incident Response Team within 24 hours of becoming aware that a vulnerability in their product is being actively exploited, or that a severe incident has occurred ^[1]. Full notification, including details of affected products, the nature of the vulnerability and any mitigation measures, must follow within 72 hours ^[1].

The Act defines when you are considered aware: it is the point at which your organisation has enough information that a person in a position to act on it would reasonably conclude that the threshold for reporting has been met ^[1]. That means you cannot delay the clock by keeping the incident away from the right people.

If the vulnerability or incident poses an imminent and severe threat, an intermediate report is due within 24 hours of the early warning, and a final report within one month of that intermediate submission ^[1].

What must be reported

The early warning, submitted within the first 24 hours, must at a minimum identify the manufacturer, describe the nature of the vulnerability or incident, and state whether it is being actively exploited ^[1]. It is a tripwire, not a full account.

The notification within 72 hours goes further. It must include the products affected by reference to their unique identifiers, an assessment of severity, the number of affected products on the EU market, technical details of the vulnerability, any mitigation measures already applied and the manufacturer's recommended response for users ^[1].

Where the vulnerability or incident meets the threshold for an imminent severe threat, the intermediate report within 24 hours of the early warning must add an initial assessment of the incident, its likely consequences and any further mitigation underway ^[1]. The final report, due within a month, includes a detailed description of the incident, its impact, the response taken and lessons learned ^[1].

Reports are submitted through ENISA's single reporting platform, which forwards them to the coordinating CSIRT and, depending on the type of product, to the relevant market surveillance or sectoral authority ^[1].

Who it applies to

The reporting duty falls on manufacturers of products with digital elements placed on the EU market ^[1]. This includes connected hardware and software, whether sold separately or embedded in a larger product. Medical devices covered by the Medical Devices Regulation and type-approved vehicles are excluded, as they have their own regimes ^[1].

If you design software that runs on someone else's hardware, or a device that connects to a network, the rule is for you. Open-source developers contributing to a project without commercial intent are not manufacturers under the Act, but the entity placing the product on the market is ^[1].

The compliance challenge

Twenty-four hours is not much time. It assumes you already know where to send the report, what information ENISA needs and who in your organisation can authorise it. It also assumes that your detection systems give you enough detail to recognise active exploitation when you see it, and that somebody in the organisation is in a position to interpret that detail and escalate it.

If the first indication of a problem comes from a customer, a researcher or a public disclosure, the 24-hour countdown may already be several hours old by the time your team hears about it.

The Act is clear that failing to report on time can result in fines of up to 15 million euros or 2.5 per cent of total worldwide annual turnover, whichever is higher ^[1]. Supervisory authorities will look at whether the delay was avoidable and whether it made the incident worse.

What a digital witness does here

The thing to seal is each step of your response as it happens: the first detection note, the decision to escalate, the submission of the early warning and each subsequent report. Sealing takes a fingerprint of the record, not the record itself, so the content stays in your own systems.

The fingerprint is sealed through WitniumChain, using the REST API, the SDK or the MCP server. Anyone you share the record with later, such as a supervisor or an auditor, can calculate the fingerprint again and check that it matches the one sealed at the time. If even a single character has changed, the match fails.

What it shows is when each step was recorded, in a way nobody can quietly rewrite afterwards. If a regulator asks why the early warning went out after 30 hours instead of 24, the sealed timeline tells you when your team knew what, and when each report was submitted. It doesn't show that the report was complete, that the response was adequate or that the underlying vulnerability has been fixed, but it does make the procedural part of the question easier to answer.

The first 2,000 witnesses a month are free, and you can start at witniumchain.com/docs.

How it would work

1. Your detection system writes a note when it flags a potential exploitation event. A fingerprint of that note is sealed immediately.
2. When the security team decides to escalate, that decision and its timestamp are sealed.
3. The early warning, as submitted through ENISA's platform, is sealed at the point of submission, along with the confirmation receipt if the platform provides one.

The sealed records sit alongside your incident logs, unchanged and independently checkable.

What this means for you

If you manufacture connected products or software for the EU market, decide now how you will detect active exploitation, who will make the decision to report, and how you will meet the 24-hour deadline even when the incident surfaces late on a Friday.

Test your reporting process before 11 September 2026. ENISA's platform will be in place by then, and knowing how to use it under pressure is easier if you have used it once without pressure.

Keep a record of when you became aware of each incident, when you escalated it and when you submitted each report. Those timestamps matter if someone later questions whether you were on time.

What to watch

The Cyber Resilience Act enters into force on 11 December 2024, with most obligations, including the reporting duty, applying from 11 September 2026 ^[1]. ENISA is developing the technical details of the single reporting platform, and manufacturers should monitor those developments to understand exactly what the platform will require.

Implementing acts under Article 14 may further specify the format and content of reports, so watch for those as well ^[1].