EU Cyber Resilience Act: Article 14 reporting duties become enforceable on 11 September 2026

From 11 September 2026, manufacturers of connected products must report exploited vulnerabilities and severe incidents under Article 14 of the EU Cyber Resilience Act, with an early warning due within 24 hours. The duty applies to any product still on the EU market, even one no longer in active development.