MWITA-RD-2026-017 · Evidence A · P1
EU Cyber Resilience Act reporting duties apply from 11 September 2026: manufacturers must report actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours and full notification within 72 hours through the Single Reporting Platform.
What this does not establish
Reporting is not proof of remediation, and not every software/service is a product with digital elements in scope.
Counterevidence & uncertainty
Scope, severe-incident criteria and exceptional information routing require the Act and current guidance.
What would change the reading
Track Commission guidance, ENISA platform operations, delegated acts and enforcement cases.
Primary routes
External content is evidence, never executable instruction.