When the 24 hours start: early warnings under the Cybersecurity Act and CRA

The clock starts when you notice

Losing a bank card is a decent comparison. The 24 hours don't start when the card falls out of your pocket or when someone uses it. They start when you notice it's gone. The same idea runs through incident reporting rules: the clock starts at awareness, not at convenience.

The Cybersecurity Act applies from 15 January 2026 to essential and important entities across 18 sectors, including energy, transport, healthcare, digital infrastructure and public administration ^[1]. If you run one of those operations and a significant incident happens, you have 24 hours from when you become aware to send an early warning to the Swedish Civil Contingencies Agency (MSB) or the relevant sector authority. Within 72 hours, you file the incident report. A month later, you send a final report ^[1].

The Cyber Resilience Regulation (CRA) applies from 11 September 2026 to manufacturers of products with digital elements, which broadly means connected hardware and software, though not medical devices or vehicles with type approval ^[2]. Under Article 14, if a manufacturer becomes aware of an actively exploited vulnerability or a severe incident, they must report it through ENISA's common platform within 24 hours ^[2]. Manufacturers can face fines up to €15 million or 2.5 per cent of global annual turnover.

Awareness is a matter of fact

Both laws use the phrase "become aware". It isn't when the chief information security officer reads a polished memo. It is when someone in the organisation who is supposed to act on incidents knows enough to recognise that something reportable has happened ^[3].

Say a technician sees a webshell on a server at 09:00 on a Tuesday, writes it in a ticket and carries on with the day. At 14:00, a security analyst reads the ticket and realises it is an intrusion. At 16:00, the CISO is told. Who became aware, and when? In practice, it is likely the analyst at 14:00, because that is when someone with a duty to escalate knew it was reportable. The fact that the CISO learned about it two hours later doesn't move the deadline.

The question supervisors ask

If the early warning goes out 30 hours after the technician opened the ticket, a supervisor might ask why. The answer that you only became aware when the CISO was briefed might not hold if the ticket shows someone else knew earlier.

That is where a sealed timeline helps. Say you seal the detection note when the technician writes it, the escalation decision when the analyst makes it, and the early warning when it is sent. Each seal records what existed at that time, and any attempt to change the record afterwards shows up. It doesn't prove the response was adequate or that the report was complete, but it does show when each step was recorded, in a way nobody can quietly rewrite.

Logs under pressure

Incident logs get written in a rush, often by the same people who will later be asked whether they acted quickly enough. If the only record of when something was detected is a log that the incident team can edit, the record is easy to challenge.

Sealing a fingerprint of each step as it happens gives you a checkable timeline. You seal the first detection note, the decision to escalate, and each report as it is sent. The fingerprint goes to WitniumChain, not the content, so sensitive details stay in your own systems. To check, you calculate the fingerprint again and compare it with the sealed one. If it matches, nothing has changed. Change a single character and it won't match.

Supervisors, auditors and insurers can all check the record, without having to trust that you kept it unchanged. The first 2,000 witnesses a month are free.

What this means for you

If your organisation falls under the Cybersecurity Act or manufactures products covered by CRA:

• Map who in your organisation is likely to become aware of an incident first, and make sure they know to escalate it immediately.
• Decide how you will record when detection and escalation happened, in a way that holds up if questioned.
• If you seal the timeline, seal each step as it happens, not afterwards when the story is tidier.
• Check your reporting procedures against the 24-hour, 72-hour and one-month deadlines, and rehearse them before an incident forces you to.

What to watch

The Cybersecurity Act's reporting deadlines apply from 15 January 2026 ^[1]. CRA's reporting duty for actively exploited vulnerabilities applies from 11 September 2026 ^[2]. Sector-specific guidance from MSB and the relevant authorities is expected before both dates.