EU Cyber Resilience Act: Article 14 reporting duties have applied since 11 September 2026
Since 11 September 2026, manufacturers of in-scope connected products must report exploited vulnerabilities and severe incidents under Article 14 of the EU Cyber Resilience Act, with an early warning due within 24 hours. Medical devices regulated under the MDR or IVDR are excluded from the Act. Within scope, the duty reaches products already on the market.