EU Cyber Resilience Act Imposes 24-Hour IoT Vulnerability Reporting Starting September 11

Reporting clock starts September 11 for EU IoT deployments

On September 11, 2026, the EU Cyber Resilience Act (CRA) began enforcing mandatory incident and vulnerability reporting for IoT devices and other connected products sold in the EU. Manufacturers must now submit an early warning within 24 hours of learning about an actively exploited vulnerability, a full notification within 72 hours, and a final report within 14 days once a corrective measure is available. These obligations apply to products already deployed, not just future sales, which means enterprises operating IoT fleets in the EU face immediate procurement and operational changes.

The regulation creates three reporting deadlines manufacturers must meet: 24 hours for initial early warning to ENISA via the CRA Single Reporting Platform, 72 hours for detailed vulnerability or incident notification, and 14 days for a final report once a patch or mitigation is available for actively exploited vulnerabilities. Severe incidents require a final report within one month after the 72-hour notification. Non-compliance can trigger penalties up to €15 million or 2.5% of global annual turnover, according to CRA commentary cited by IoT security vendors.

What changes for enterprise buyers immediately

Procurement criteria must now include contract language ensuring manufacturers can meet CRA reporting clocks. In practice, this requires suppliers to maintain centralized IoT device inventory and telemetry, deploy remote firmware update capabilities with rollback and audit trails, and map vulnerabilities to specific product SKUs and affected customer deployments. Security by design and vulnerability handling across the support period shift from optional features to hard regulatory requirements.

Enterprises conducting vendor due diligence should now ask three specific questions: Can the supplier produce and share machine-readable SBOMs for IoT firmware? What are their documented time-to-patch metrics for IoT firmware? How does their incident-reporting process map to CRA's 24/72/14-day timelines? Suppliers unable to answer these questions create regulatory and operational risk for buyers, as late or incomplete reports expose both parties to enforcement and potential downstream litigation.

Budget impact will concentrate in two areas. First, enterprises with large IoT fleets in the EU will need to upgrade or replace non-updateable or poorly managed devices before December 11, 2027, when the CRA's main obligations covering security by design, documentation, and conformity assessment become fully applicable. Second, operational budgets must now include investment in device management platforms, SBOM tooling, and security operations integration capable of supporting near real-time vulnerability reporting across multiple suppliers. This creates a new category of regulatory spend comparable in scope to GDPR readiness, but focused on product security and lifecycle management rather than data protection.

Competitive advantage shifts to platforms with automated device lifecycle management

IoT security and device management vendors gain a compliance-driven sales narrative. CRA requires manufacturers to demonstrate vulnerability handling across the support period and maintain technical documentation and security governance covering all EU SKUs. This privileges platforms that can automate asset discovery, firmware inventory, and patch rollout across diverse IoT fleets.

Vendors emphasizing SBOMs and automated vulnerability correlation gain particular advantage. Machine-readable SBOMs for IoT firmware are becoming de facto necessary to meet the 24-hour reporting requirement, because manufacturers must quickly understand where a vulnerability is present across product lines. Compliance-focused IoT security specialists now position themselves as enablers of EU market access rather than optional controls, arguing that security updates must cover at least a five-year product lifecycle and confirmed security incidents must be reported within 72 hours.

What to watch through December 2027

The September 11 reporting deadline is the first of three enforcement dates. The main obligations become fully applicable on December 11, 2027, and the transitional period for certificates issued under prior regimes ends June 11, 2028. Enterprises should expect RFPs and vendor questionnaires to start including explicit questions on SBOM production practices, time-to-patch metrics, and incident-reporting processes mapped to CRA timelines.

For global enterprises, CRA effectively becomes a baseline requirement for IoT security and device management, influencing procurement even outside the EU as vendors harmonize global processes around the strictest regime. The regulation creates a forcing function for IoT manufacturers to either invest in secure device lifecycle management or exit the EU market. Buyers gain leverage to demand capabilities that were previously optional, with regulatory penalties providing enforcement the market alone could not.