Europe's 24 hour clock is already running.
The hard part is not the disclosure. It is knowing in time to make one.
Since 11 September 2026, manufacturers that make products with digital elements available in the European Union must report actively exploited vulnerabilities and severe incidents that affect their security.
An early warning is due within 24 hours of becoming aware. A fuller notification follows within 72 hours, and a final report lands once a corrective measure is available.
For most software firms this is a new kind of obligation, because the audience for a disclosure used to be customers rather than a regulator. It also arrives while Brussels is stacking up technology law, as covered in our look at how the EU AI Act became enforceable law.
It lands on a profession that is already slower than most people assume at noticing trouble.
IBM's 2026 Cost of a Data Breach Report, built from more than 600 breached organisations studied by the Ponemon Institute, put the mean time to identify and contain a breach at 247 days. That reversed five straight years of improvement, and it came with a record average breach cost of 4.99 million dollars.
Verizon's 2026 Data Breach Investigations Report added pressure from the other direction. Exploited vulnerabilities overtook stolen credentials as the leading way into an organisation, which is a faster entry point than most change windows were built to close.
The reporting clock only starts when you become aware, so the deadline that actually matters is your detection time.
The clock starts at awareness, and awareness is slow
Read the timeline again with that in mind. Those 24 hours do not begin at the moment of compromise. They begin when you become aware of an actively exploited vulnerability in something you built and sold.
Everything you have not noticed is not on the clock yet. Everything you notice late arrives with the clock already against you.
That inverts the usual compliance work, because most teams prepare for a deadline by drafting documents. This deadline is decided by telemetry, triage and escalation instead.
Three things worth doing this month
- Map what is in scope and decide who speaks. List every product with digital elements you place on the EU market, find the CSIRT for the country of your main establishment, and name one person plus a backup who can file through ENISA's Single Reporting Platform. Keep those credentials somewhere that still works while systems are being locked down, because the middle of an incident is a bad time to learn that the login lived in the mailbox you just disabled.
- Build the escalation path, then time it. 24 hours is roughly one investigation cycle plus one decision. Draft the fields the early warning needs in advance, keep an incident log that timestamps every signal automatically rather than reconstructing a story afterwards, and rehearse who signs the first notification at three in the morning. That is ordinary containment discipline, and it is what incident response planning for a small team ultimately has to cover.
- Watch exploitation of your own product, not just your network. Exploitation is now the leading way in, so vendor advisories, the CISA Known Exploited Vulnerabilities catalog and your own exploit telemetry are the early warning system. The same reasoning applies to the ways attackers break in through the tools that ship your software, where nothing touches your perimeter at all. An organisation that learns about exploitation from a frustrated customer has already spent most of its window.
The old model let you investigate first, agree the wording, and disclose at a moment of your choosing.
The new model starts the timer when you become aware, which makes detection speed the part of compliance you cannot delegate to legal.
If you want to know whether your fundamentals would hold up under that pressure, take the free cybersecurity fundamentals check and get a scored result instead of an opinion.
If your team found evidence tomorrow that someone was actively exploiting a flaw in a product you sell, who would write the first notification, and what would they need that you cannot produce today?
<small>Sources: the European Commission on Cyber Resilience Act reporting obligations and ENISA on the Single Reporting Platform; Help Net Security on the 2026 Cost of a Data Breach Report; SecurityWeek on the 2026 Verizon DBIR. Images: the Berlaymont building by EmDee, shared under a Creative Commons Attribution ShareAlike 4.0 licence; National Security Operations Center watch floor by the National Security Agency, public domain; CE marking symbol by ETRAEU, released under CC0, all via Wikimedia Commons.</small>