Under Article 14 of the EU Cyber Resilience Act, which took effect on September 11, 2026, manufacturers of connected hardware and software must report actively exploited vulnerabilities within 24 hours of becoming aware of them