Vulnerability Disclosure

Cyber Resilience Act reporting becomes a live legal duty on 11 September 2026, fifteen months before the rest of Regulation (EU) 2024/2847 applies. This operational guide covers the two triggers that start the clock, what “becoming aware” means, the 24-hour early warning, the 72-hour notification and the 14-day or one-month final report, the ENISA single reporting platform and how to choose a coordinating CSIRT, what each submission must contain, who is authorised to file out of hours, the parallel duty to notify users, how the clocks interact with NIS2, DORA and UK GDPR, the evidence pack, the penalty bands, and a four-week readiness plan.