Under Article 14 of the EU Cyber Resilience Act, which took effect on September 11, 2026, manufacturers of connected hardware and software must report actively exploited vulnerabilities within 24 hours of becoming aware of them

From the articleEU Cyber Resilience Act Goes Live: Manufacturers Now Face 24-Hour Deadline to Report Exploited FlawsAlso in Crypto wallet creators now have just 24 hours to alert regulators when flaws are exploited