Incident disclosure deadlines

Manufacturers selling into the EU now owe ENISA a 24-hour warning on exploited flaws

The Cyber Resilience Act's vulnerability reporting duties are already in force, well before the December 2027 date that governs most of the regulation, and they sit alongside five other disclosure regimes whose clocks start differently.