EU Cyber Resilience Act reporting from 11 September 2026, and the Data Act's design duty for connected products placed on the market after 12 September

Why the reporting duty came before the rest of the Regulation

The Cyber Resilience Act entered into force on 10 December 2024 and applies, as a whole, from 11 December 2027: the essential cybersecurity requirements of Annex I, the conformity assessment, the CE marking and the market surveillance machinery all start then (Article 71(2)). Two parts were brought forward. Chapter IV, on the notification of conformity assessment bodies, applies from 11 June 2026, so that the bodies exist before manufacturers need them. Article 14, the reporting obligation, applies from 11 September 2026. And Article 69(3) provides that the obligations laid down in Article 14 apply to all products with digital elements within the scope of the Regulation that have been placed on the market before 11 December 2027, so the reporting duty is not confined to new products: a product sold into the Union in 2024 is within it from 11 September 2026 as much as a product sold next year.

Reporting needs no conformity assessment and no CE marking; it needs a manufacturer who knows that a vulnerability in its product is being exploited, or that an incident has compromised the product's security, and a channel to the authorities. Article 16 gives ENISA the task of building that channel, the single reporting platform. On 11 September 2026 ENISA announced that it had deployed the initial operating capability of the platform, and the Commission's reporting page describes the platform as operational from that date. On 27 July 2026 the Commission published guidance on the application of the Regulation (C(2026) 5252), which deals with the reporting obligations in its section 9, and on 4 September 2026 it updated its frequently asked questions; both are guidance and rank below the Regulation.

What Article 14 requires

The duty falls on the manufacturer, which Article 3 defines as the natural or legal person who develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge. Two events trigger it. Under Article 14(1) the manufacturer must notify any actively exploited vulnerability contained in the product that it becomes aware of; under Article 14(3), any severe incident having an impact on the security of the product. Article 14(5) sets the severity test: an incident is severe where it negatively affects, or is capable of negatively affecting, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or where it has led, or is capable of leading, to the introduction or execution of malicious code in the product or in the network and information systems of a user. The manufacturer's own assessment of those words has to be made within hours of discovery, with the Commission's guidance and frequently asked questions as the published help.

The clock runs from the moment the manufacturer becomes aware, and each stage is due without undue delay and in any event within the period stated. For an actively exploited vulnerability, Article 14(2) requires an early warning within 24 hours, indicating where applicable the Member States on whose territory the manufacturer is aware the product has been made available; a vulnerability notification within 72 hours, unless the information has already been provided, with general information about the product, the nature of the exploit and the vulnerability, any corrective or mitigating measures taken or that users can take, and an indication of how sensitive the information is; and a final report no later than 14 days after a corrective or mitigating measure is available. For a severe incident, Article 14(4) requires the early warning within 24 hours, stating at least whether the incident is suspected of being caused by unlawful or malicious acts, an incident notification within 72 hours and a final report within one month after the incident notification was submitted. Article 14(8) adds the duty towards the market: after becoming aware of an actively exploited vulnerability or a severe incident, the manufacturer must inform the impacted users of the product, and where appropriate all users, of the vulnerability or incident and, where necessary, of risk mitigation and corrective measures they can deploy, where appropriate in a structured, machine-readable format; if the manufacturer does not inform users in a timely manner, the CSIRT may do so.

The report goes to two addressees at once: the CSIRT designated as coordinator in the relevant Member State, and ENISA, through the single reporting platform (Article 14(1) and (3), read with Article 16). Which Member State is relevant is decided by Article 14(7). For a manufacturer with its main establishment in the Union, it is the Member State of that establishment: the Member State where the decisions related to the cybersecurity of its products are predominantly taken or, if that Member State cannot be determined, the Member State where the manufacturer has the establishment with the highest number of employees in the Union. Where a manufacturer has no main establishment in the Union, the Article works down a list, on the information available to the manufacturer: the Member State of the authorised representative acting for the highest number of its products, then of the importer placing the highest number on the market, then of the distributor making the highest number available, and finally the Member State with the highest number of users. A Swiss, UK or US manufacturer without a main establishment in the Union therefore selects its CSIRT, in practice, when it appoints its authorised representative.

Article 15 allows manufacturers and other persons to report vulnerabilities, cyber threats, incidents and near misses voluntarily. Under Article 16(2), the CSIRT that first receives a notification disseminates it through the platform to the CSIRTs of the Member States where the product has been made available, and in exceptional circumstances may delay dissemination on justified cybersecurity-related grounds; Delegated Regulation (EU) 2026/881, adopted under Article 14(9), specifies the terms and conditions for applying those grounds. Neither provision changes the manufacturer's deadlines.

Who else is in the chain

Importers and distributors do not report under Article 14, and their own duties apply with the rest of the Regulation from 11 December 2027. From then, an importer must inform the manufacturer and the market surveillance authorities where a product presents a significant cybersecurity risk, and must inform the manufacturer without undue delay of a vulnerability it becomes aware of (Article 19(3) and (5)); Article 20(3) and (4) place parallel duties on distributors. Article 18, on authorised representatives, also applies only from that date, although Article 14(7) already uses the representative's location to select the CSIRT. When it applies, Article 18(2) excludes from the mandate the manufacturer's obligations in Article 13(1) to (11), the first subparagraph of Article 13(12) (drawing up the technical documentation) and Article 13(14), and Article 18(3) requires the mandate at least to allow the representative to keep the EU declaration of conformity and the technical documentation at the disposal of market surveillance authorities, to provide information on reasoned request and to cooperate on measures to eliminate risks. Article 14 is not among the excluded obligations. In our judgement the mandate can task the representative with filing the notifications, but the obligation, and the exposure for a late or missing report, remains the manufacturer's.

Open-source software is treated separately. The Regulation applies to products made available on the market, which Article 3 defines by reference to supply in the course of a commercial activity, and recital 18 explains that free and open-source software supplied outside a commercial activity is on that basis outside it; the obligations of open-source software stewards under Article 24 apply only from 11 December 2027, when Article 24(3) subjects stewards to parts of Article 14. A company that integrates an open-source component into a product it places on the market is the manufacturer of that product, and the Article 14 duty for that product is its own.

The penalties are in Article 64, which applies from 11 December 2027. It sets maximum administrative fines of EUR 15 million or, for an undertaking, 2.5 per cent of total worldwide annual turnover in the preceding financial year, whichever is higher, for breaches of Annex I and of Articles 13 and 14; EUR 10 million or 2 per cent for the obligations listed in Article 64(3), including those of importers and distributors; and EUR 5 million or 1 per cent for incorrect, incomplete or misleading information supplied to notified bodies or market surveillance authorities in reply to a request. Under Article 64(10), as corrected by the corrigendum of 2 July 2025, manufacturers that qualify as microenterprises or small enterprises are not fined for missing the 24-hour early-warning deadline. The fines are imposed by Member State authorities under national rules from December 2027; the reporting duty applies now.

The Data Act: access by design for products placed on the market after 12 September 2026

The second date concerns a different instrument. The Data Act, Regulation (EU) 2023/2854, has applied since 12 September 2025, and its users' rights to access and share the data generated by connected products and related services, in Articles 4 and 5, already bind data holders. Article 3(1) is the design duty: connected products must be designed and manufactured, and related services designed and provided, in such a manner that product data and related service data, including the relevant metadata necessary to interpret and use them, are, by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, directly accessible to the user. Article 50 applies that duty to connected products and the services related to them placed on the market after 12 September 2026. A product placed on the market on or before that date is outside Article 3(1), though not outside the access rights that attach to its data. Article 7(1) qualifies the whole of Chapter II, Articles 3 to 5 included: its obligations do not apply to data generated through the use of connected products manufactured or designed, or related services provided, by a microenterprise or small enterprise that has no partner or linked enterprise failing to qualify as micro or small and is not subcontracted to manufacture or design the product or to provide the service. The same applies to an enterprise that has qualified as medium-sized for less than one year, and to connected products for one year after a medium-sized enterprise placed them on the market. Size is measured under the Annex to Commission Recommendation 2003/361/EC by staff headcount together with turnover or balance sheet total, with the data of partner and linked enterprises added, so the group and subcontracting position has to be checked before the points below are applied.

Article 3(1) is a product requirement, so it reaches the design file and the component supply chain as well as the terms of service. The practical consequence for manufacturers outside the Union follows from Article 1(3), which applies the Regulation to manufacturers of connected products placed on the market in the Union and providers of related services irrespective of their place of establishment, and to data holders that make data available to recipients in the Union. Article 2(22) defines placing on the market as the first making available of a connected product on the Union market, so on that definition the test applies unit by unit: a connected device first made available on the EU market in October 2026 must meet Article 3(1) unless Article 7(1) applies to it, and a unit of the same model placed on the market before 13 September 2026 need not.

What the two dates do to contracts and procedures

Four pieces of paper change. The first is the incident-response procedure: it needs a decision rule for "actively exploited" and "severe", a named person who can file on the platform within 24 hours including at weekends, the EU Login accounts the platform requires, and templates for the three stages. The second is the authorised representative's mandate for manufacturers outside the Union, which should say whether the representative files Article 14 notifications, on what information and within what internal deadline, and which Member State's CSIRT the arrangement selects under Article 14(7). The third is the supply and distribution contract: component suppliers should be bound to disclose vulnerabilities to the manufacturer within a period that leaves room for the 24-hour early warning, and importers and distributors should be bound now to pass on what Articles 19 and 20 will require of them from 11 December 2027. The fourth is the product specification for anything placed on the EU market after 12 September 2026, which should record whether Article 7(1) applies and, if it does not, how Article 3(1) is met and how data that are trade secrets will be handled under Article 4(6) to (8): they are disclosed only once confidentiality measures are in place, and may be withheld or refused only on the conditions in Article 4(7) and (8).

In our judgement the reporting duty is the one to close first, because it already applies to the products a company sold years ago, because its deadlines are counted in hours, and because, under Article 16(3), what a company notifies is passed to the market surveillance authorities that will be enforcing the rest of the Regulation from December 2027.

What this means for you

• The reporting duty already applies to what you have sold. Article 69(3) extends Article 14 to all in-scope products with digital elements placed on the market before 11 December 2027. Inventory the products with digital elements on the EU market, old and new, and attach an owner to each.
• Build the 24-hour capability before you need it. Create the EU Login accounts with multi-factor authentication for the people who will file, settle who acts for the manufacturer on ENISA's platform (ENISA asks manufacturers to register only when a notification is due), write the decision rule for actively exploited vulnerabilities and severe incidents against Article 14(5), and rehearse the three stages with the Commission's guidance of 27 July 2026 at hand.
• Non-EU manufacturers: know which CSIRT Article 14(7) selects. Check first whether Article 14(7) places your main establishment in the Union, including through its fallback to the Member State of your establishment with the most employees in the Union; without a main establishment there, the Member State follows the authorised representative acting for the most products, then the importer, then the distributor, then the users. Put the filing task, the information flow and the internal deadline into the representative's mandate.
• Bind the supply chain to your clock. Component and software suppliers should be bound to disclose vulnerabilities fast enough for the early warning; importers and distributors should be bound now to pass on what Articles 19 and 20 will require of them from 11 December 2027. Both belong in the contract, with remedies.
• Separate the two September dates. Article 14 of the CRA applies to products already on the market; Article 3(1) of the Data Act applies to connected products placed on the market after 12 September 2026, unless the size exceptions in Article 7(1) apply. The product specification should show, for each product line, whether Article 7(1) applies and, if not, from when units placed on the market meet Article 3(1).

Isak Legal advises manufacturers, software companies and their distributors on the Cyber Resilience Act, the Data Act, NIS2 and the contractual arrangements that carry those duties through the supply chain, for companies established in the EU, Switzerland, the United Kingdom, the United States and Ukraine. See our AI, Data & Technology and Europe pages, or get in touch.

This client update is provided for general information only, reflects the position as at 15 September 2026 and does not constitute legal advice or create a lawyer-client relationship. The application dates are taken from Article 71 and Article 69(3) of Regulation (EU) 2024/2847 and from Article 50 of Regulation (EU) 2023/2854, and the size exceptions from its Article 7(1); the reporting mechanics from Articles 14 to 16 of Regulation (EU) 2024/2847; the fines from Article 64. The Commission's guidance and frequently asked questions and ENISA's platform announcements are guidance and operational material and rank below the Regulation; Articles 18 to 20 and 64 of Regulation (EU) 2024/2847 apply from 11 December 2027. Verify the current texts and dates at the official sources linked above before acting. For advice on a specific matter, please contact us.