The EU's 24-hour exploitation report binds product manufacturers from September 11

The trigger is a reasonable degree of certainty that a vulnerability is being exploited, or that an incident has severely compromised product security, and that call has to be made in hours, usually on partial telemetry ^[7]. A manufacturer cannot slow the clock by not looking: the standard does not allow the duty to be deferred by declining to investigate ^[7].

Article 14 attaches on September 11, 2026 ^[1][17], while the CRA's requirement that manufacturers publish a coordinated vulnerability disclosure policy does not apply until December 2027 ^[13]. For those 15 months, manufacturers owe regulators a 24-hour report on exploitation they may only hear about through intake channels they are not yet obliged to run ^[18].

The ceiling for breaching core manufacturer obligations is 15 million euros or 2.5% of global annual turnover, whichever is higher ^[10]. Divide 15 million by 0.025 and the crossover sits at 600 million euros of turnover ^[16]. Below that, the fixed sum is the exposure; above it, the percentage takes over and keeps climbing.

The harmonised standards that will define what adequate compliance looks like are still working through public enquiry, so the processes being built this month are being built against a moving target ^[12]. That affects the 72-hour and 14-day filings more than the 24-hour one, because the early warning is a short factual notice while the later reports are where a regulator can second-guess method.

Downstream of the manufacturers, the change is about whose clock governs. Enterprise buyers will start receiving vendor notifications on the vendor's schedule rather than their own, which requires a defined route from a supplier advisory into incident triage, plus a fast read on whether the same event also triggers duties under NIS2 or DORA ^[14].

Adobe confirmed this week that a maximum-severity Magento flaw, CVE-2026-75650, has been exploited against merchants since September 4 ^[15]. That sequence began before the duty attached. The same disclosure a week later would have put a 24-hour early warning into a designated national CSIRT, and through it into every member state where the product is sold ^[15][5].