The Cyber Resilience Act's twenty-four-hour clock started on Friday. The duty to be capable of noticing starts fifteen months later.

The reporting obligations in Article 14 of the Cyber Resilience Act applied from 11 September 2026, which was Friday. The rest of the regulation — the security properties a product has to have, the conformity assessment, the CE mark, the bill of materials — applies from 11 December 2027.

What changed on Friday is that a manufacturer who learns that a vulnerability in its product is being exploited must tell two authorities within twenty-four hours.

What did not change is anything about how a manufacturer would come to learn that.

We should say at the outset that we have not had the consolidated text open at this desk for this piece. Article 14 is named because the reporting duty lives there; the rest is described rather than numbered, and the source notes say which of it we have verified and which we have not.

The regulation was split, and the half that arrived first is the half that assumes the other

Two dates, fifteen months apart, is not an accident of drafting. The reporting duty was moved forward deliberately, on the reasoning that the Union should start seeing exploited vulnerabilities in commercial products before it starts regulating those products' construction. As a policy instinct that is sound. ENISA gets a year of data before the regime it has to supervise switches on.

The consequence is a sequencing artefact that nobody appears to have costed. The requirements that would produce the knowledge — a coordinated vulnerability disclosure policy, a published contact point for researchers, a process for handling what comes in, the bill of materials that tells you which of your products contains the component in the advisory — sit in the December 2027 half.There are more obligations in the 2027 half than four, and several of them are heavier. These are the ones that generate the input the September duty consumes.

So for fifteen months the obligation to report runs ahead of the obligation to be in a position to have anything to report.

The trigger is knowledge, and knowledge is currently discretionary

The clock starts when the manufacturer becomes aware. Awareness, on our reading, means reliable evidence that malicious code has been executed against a system without the owner's permission — not that the vulnerability exists, not that it is theoretically reachable, but that somebody has used it.

Read the two halves together and the effect is plain. A manufacturer with good telemetry, a monitored disclosure inbox and a relationship with the research community becomes aware early and reports within a day. A manufacturer with none of those becomes aware when a customer forwards a news article, and reports within a day of that. Both have complied.

This is not a loophole anyone drafted. It is what happens when you commence a duty to speak before the duty to listen.

A twenty-four-hour clock is only as fast as the moment it starts, and the moment it starts is still a matter of how hard you were looking.

It closes in December 2027, which is the point. It is open now, which is also the point, because the reporting duty already sits in the upper band of the fining scale and the enforcement of it does not wait for the rest.

Manufacturer is a wider word than the hardware industry has assumed

The regulation attaches to products with digital elements made available on the Union market, and the entity that develops one and puts it out under its own name is the manufacturer. Supply free of charge counts as making available. Software is a product with digital elements.

Nearly all the readiness material we have seen is addressed to firms that manufacture things. Our readers mostly do not. They do, however, ship a mobile application under their own brand to several million people in the Union, at no charge, and some of them run a customer portal that would be described by its own architects as a product.

Whether that is inside the scope of this regulation, we could not establish, and we are not going to guess in front of an audience that would have to act on the answer. The exclusions and the treatment of remotely provided data processing are where it turns, and neither is a paragraph you should take on trust from somebody's slide. What we can say is that the question is live, that the firms asking it are not getting a clean answer, and that a scope question with a fifteen-month gap in front of it is one worth settling early rather than in the week it bites.

Two recipients, one platform, and an assumption about the Member States

The early warning goes to the CSIRT designated as coordinator in the relevant Member State and to ENISA, at the same time, through a single reporting platform the regulation provides for. Three stages follow the first: a fuller notification at seventy-two hours, and a final report after that.

All of which assumes the platform accepts submissions and every Member State has designated its coordinator. Whether both of those were true on Friday, we could not establish. It is the sort of question that produces a confident answer from the Commission and a different answer from whoever tries to file at two in the morning on a public holiday.

What the text declines to do

It does not make the report public. Nothing in the twenty-four-hour duty tells the market, the affected customers or the researcher who found it. That is a choice, and a defensible one — a live exploited vulnerability broadcast on day one is a worse outcome for everybody — but it means the visible effect of this obligation for the next fifteen months is a number in an ENISA statistic.

And it does not, so far as we can tell, resolve the case that will come up most: the exploited vulnerability sitting in a component the manufacturer did not write. The duty to know what is in your product arrives in December 2027. The duty to report what is being done with it arrived on Friday.

The first quarter of filings will be small, and everyone will read that as compliance. It is at least as likely to be the other thing.