Security incident reporting

CRA's 24-hour clock starts when the manufacturer becomes aware of active exploitation

Article 14 of the EU Cyber Resilience Act became directly applicable on 11 September 2026. The early warning to ENISA falls due within 24 hours of awareness, so the path from support inbox to filing is what most vendors still have to build.