The Regulation applies in full from December 2027, which is how most plans treat it. One article does not wait: since 11 September 2026 a manufacturer has 24 hours to report an actively exploited vulnerability, 72 for the notification and 14 days for the final report — and that duty sits in the higher penalty tier.
Part of it is already binding
The EU Cyber Resilience Act applies in full from 11 December 2027, and most plans treat it as a 2027 problem. It is not entirely. One part of it — the duty to report — has applied since 11 September 2026, and the chapter on conformity assessment bodies since 11 June 2026.
So the obligation measured in hours is live now. The obligations that take a year of engineering work are not.
Who counts as a manufacturer
The Act covers products with digital elements sold in the EU whose intended or foreseeable use involves a connection, direct or indirect, to a device or a network. Software sold under your own name is covered. So is connected hardware. So is a product you have rebranded.
In short: if it goes on the EU market under your name, the manufacturer's duties are yours, whoever actually wrote the code.
What has to be reported, and how fast
Two things start the clock: a vulnerability in your product that is actively being exploited, and a serious incident affecting its security. Both go at the same time to the coordinating national CSIRT and to ENISA, through a single reporting platform.
| Step | Deadline from the moment you know |
|---|---|
| Early warning | Without delay, and in any case within 24 hours |
| Full notification | Without delay, and in any case within 72 hours |
| Final report | 14 days after a fix or workaround is available |
The early warning says which countries you know the product has been sold in and, for an incident, whether you suspect someone did it deliberately. The 72-hour notification covers what the vulnerability is and how it is being exploited, what you have done about it, what users can do themselves, and how sensitive you consider the information to be. The final report sets out how bad it was, what is known about who was behind it, and what you shipped to fix it.
Three deadlines that start when you “become aware” are a process question before they are a legal one. Someone has to be able to decide, outside office hours, that the clock has started.
What arrives in December 2027
The substantive duty is worth starting on early, because it is not a paperwork exercise. Products have to be designed, developed and made to the Act's security requirements. The security risk assessment behind that has to be written down and kept up to date. Vulnerabilities, including ones in third-party components you used, have to be handled properly.
Then the provision that changes how you plan a product. You decide the support period yourself, based on how long the product is realistically going to be in use — and it has to be at least five years, unless the product genuinely has a shorter life. Five years of handling vulnerabilities is a commitment you make at launch. It is cheap to design for and expensive to add afterwards.
What it costs to get wrong
Countries set their own penalties, but the Act fixes the ceilings. Breaching the essential security requirements, or the duties on design and reporting, carries fines of up to EUR 15 million or 2.5 % of worldwide annual turnover, whichever is higher. A second level of EUR 10 million or 2 % covers other duties.
Note which level the reporting duty is in. The obligation that is already live sits in the higher one.
What to do this quarter
Decide whether you are a manufacturer. If you rebrand or sell under your own name, assume you are until someone shows otherwise.
Write the 24-hour path down — who decides that a vulnerability is actively exploited, who files the report, and what happens at 2am on a Saturday.
Settle the support period before your next launch. Five years is the floor, and the number is yours to justify.
Which Latvian authority supervises this, and what the national penalties are, is set nationally and worth confirming locally.