EU Cyber Resilience Act's New Vulnerability Reporting Rules Now Active

New provisions of the EU's Cyber Resilience Act, effective September 11, 2026, now mandate that hardware and software manufacturers report actively exploited vulnerabilities and severe security incidents within 24 hours of discovery. This regulation impacts global technology companies selling products in the European Union. The rules aim to enhance cybersecurity and consumer protection by accelerating the disclosure and remediation of critical security flaws across the EU market.