In this article
Since September 11, 2026, manufacturers of products with digital elements on the EU market must report certain actively exploited vulnerabilities and severe incidents. Other main Cyber Resilience Act obligations apply later. Official source.
A practical check
Identify the manufacturer, product, vulnerability channel, and person responsible for reporting. Document the incident timeline and consult the official reporting platform.
A connected device sold online may be affected by a flaw reported to its maker. The retailer should know whom to contact and how to inform customers, while the manufacturer assesses and reports covered incidents.
What the evidence supports
The 24-hour and 72-hour deadlines apply to covered cases. A simple retailer should not assume it is the manufacturer without assessing its role. Date the check and retain the source documentation so that later changes can be verified.
Who must report
The Commission describes reporting duties for actively exploited vulnerabilities and severe incidents affecting the security of covered digital products. They concern manufacturers and products made available in the EU, including products already on the market. A reseller should distinguish its own role from the manufacturer's while knowing how to forward a customer alert quickly.
Prepare an alert chain
Maintain an inventory of products, versions, and suppliers. Assign a technical contact and a backup; document how to classify a report, preserve useful evidence, and reach the manufacturer. For a confirmed case, the Commission describes short deadlines: an early warning within 24 hours and a full notification within 72 hours for the responsible manufacturer. An email left in a general sales inbox can become an operational risk.
Response example
A customer reports unauthorized access to a connected camera. The seller records the model and version without publishing exploitable details, alerts the manufacturer promptly, and follows guidance for protecting buyers. The manufacturer assesses the incident and uses the designated reporting platform. The store updates customer communication when facts and corrective steps are confirmed.
Questions for connected product stores
Who receives a report? Publish a clear customer contact and give support staff a route to the manufacturer without delay.
What should be retained? Model, version, date, symptom description, and a callback route, with access limited to people handling the alert.
Should details be published immediately? Customer protection may require prompt communication, but avoid exploitable details or unconfirmed conclusions. Coordinate the message with the manufacturer and relevant authorities for the case.
