The Regulation applies in full from December 2027, which is how most plans treat it. One article does not wait: since 11 September 2026 a manufacturer has 24 hours to report an actively exploited vulnerability, 72 for the notification and 14 days for the final report — and that duty sits in the higher penalty tier.
One article of it is already binding
Regulation (EU) 2024/2847, the Cyber Resilience Act, applies in full from 11 December 2027, and most plans treat it as a 2027 problem. Article 71 makes two exceptions, and one has already passed: Article 14 has applied since 11 September 2026, and Chapter IV since 11 June 2026.
Article 14 is the reporting duty. The obligation measured in hours is live now; the obligations that take a year of engineering are not.
Who counts as a manufacturer
The Regulation covers products with digital elements made available on the market whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. Software placed on the market under your own name is within it, as is connected hardware, as is a product you have rebranded. If it goes on the EU market under your name, the manufacturer obligations are yours, whoever wrote the code.
What has to be reported, and how fast
Two triggers: an actively exploited vulnerability in the product, and a severe incident affecting its security. Both go simultaneously to the coordinating CSIRT and to ENISA, through the single reporting platform.
| Step | Deadline from becoming aware |
|---|---|
| Early warning | Without undue delay, in any event 24 hours |
| Full notification | Without undue delay, in any event 72 hours |
| Final report | 14 days after a corrective or mitigating measure is available |
The early warning names the Member States where you know the product has been made available, and for an incident says whether malicious acts are suspected. The 72-hour notification covers the nature of the vulnerability and the exploit, measures taken, what users can do themselves, and how sensitive you consider the information. The final report sets out severity and impact, what is known about the actor, and the remedy shipped.
Three deadlines running from “becoming aware” are a process question before they are a legal one: someone has to be able to decide, out of hours, that the clock has started.
What follows in December 2027
Article 13 is the substantive obligation, and it is worth starting early because it is not a paperwork exercise. Products must be designed, developed and produced to the essential requirements in Annex I; the cybersecurity risk assessment behind that must be documented and kept updated; vulnerabilities, including in third-party components, must be handled under Annex I Part II.
Then the provision that changes product planning: the manufacturer sets the support period, reflecting how long the product is expected to be in use, and it must be at least five years unless the product is genuinely used for less. Five years of vulnerability handling is a commitment made at launch — cheap to design for, expensive to retrofit.
What it costs to get wrong
Member States set the penalties, but the Regulation fixes the ceilings. Breach of the Annex I essential requirements or of Articles 13 and 14 carries fines of up to EUR 15,000,000 or 2.5 % of total worldwide annual turnover, whichever is higher. A second tier of EUR 10,000,000 or 2 % covers other obligations. The duty already in force sits in the higher tier.
What to do this quarter
Decide whether you are a manufacturer. If you rebrand or sell under your own name, assume yes until shown otherwise.
Write the 24-hour path down — who decides a vulnerability is actively exploited, who files, and what happens at 2am on a Saturday.
Settle the support period before the next launch. Five years is the floor and the figure is yours to justify.
Which Latvian authority supervises this, and the national penalty rules, are set nationally and are the point to confirm locally.