EU Cyber Resilience Act: Connected Product Brands Have Until September 11
From September 11, 2026, manufacturers of connected products sold in the EU must have active vulnerability reporting systems in place — any actively exploited vulnerability must be reported to ENISA within 24 hours of discovery, with a full notification due within 72 hours. The obligation applies to US-headquartered brands regardless of location, and the infrastructure to meet it cannot be built on the day a vulnerability is discovered.