In the first hours of an incident?
Speak to counsel — +351 919 497 920 — monitored outside working hours · first stepsMost Cyber Resilience Act planning is anchored to December 2027. For reporting, that is the wrong date — and the right one has already passed.
Article 14 has applied since 11 September 2026. It did not wait for the Regulation to apply in full, and it does not follow the transitional rule most people have read.
Article 69(2) provides that products placed on the market before 11 December 2027 fall under the Regulation only if substantially modified from that date. Read alone, it suggests the existing catalogue is untouched. Article 69(3) then carves Article 14 back out of it, by express derogation.
The consequence is uncomfortable. A product placed on the market in 2019, never modified, still available — the reporting duty already reaches it.
They run from awareness of an actively exploited vulnerability, or of a severe incident affecting the security of the product. Not from confirmation. Not from the end of the investigation.
This is a current-portfolio problem, not a future-product problem. The question is not what you will place on the market. It is what you already have, and whether you would know if it were being exploited.
You cannot report what you cannot detect. A 24-hour deadline assumes someone is watching, that the escalation path already exists, and that the judgement on “actively exploited” can be made in hours rather than days. For most manufacturers the difficulty is not the filing. It is knowing, on the day, that there is something to file.
The scope is narrower than it first appears — ordinary bugs and routine patches are out.
The obligation is not. It started two weeks ago.
This is general information on European digital regulation, not legal advice on any particular situation. Applicability turns on facts, including whether a given product falls within the definition of a product with digital elements and whether a vulnerability is actively exploited within the meaning of Article 14.
Related: Cyber Resilience Act in the Hub · Cybersecurity & Incident Response
Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.