Mandatory vulnerability and incident disclosure

The CRA's 24-hour exploitation clock starts 456 days before its engineering rules do

Manufacturers selling into the EU owe a regulator notice within 24 hours of learning that a product flaw is being exploited, while the design rules that would produce the records needed to answer arrive 456 days later.