2026 BUSINESS LAW UPDATE
Published 13 November 2026 · Developments reviewed for this update.
Cyber Resilience Act reporting obligations for manufacturers began on 11 September 2026. They concern actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements.
What it means for businesses
The Commission describes an early warning within 24 hours and a fuller notification within 72 hours of awareness. Final-report deadlines differ between vulnerabilities and incidents. Reporting uses the single reporting platform. Manufacturers need a response process connecting technical detection, legal assessment and notification responsibilities.
Make the reporting process usable during an incident
A reporting obligation is only effective if the business can identify the relevant product, event and responsible team quickly. Map product ownership, vulnerability intake, supplier dependencies and the route from technical staff to legal assessment. Distinguish the reporting question from broader security remediation, customer communications and other notification regimes. One incident may require several assessments with different triggers, recipients and information needs.
Implementation and documentation
Prepare a response workflow with deputies, evidence preservation and a record of when the business became aware of the relevant facts. Supplier contracts should require timely cooperation and access to information needed for the assessment. Test the process using a realistic scenario, including weekends or the absence of key staff. After an incident, review both the technical correction and whether information reached the decision-makers in time; a policy document alone does not establish an effective response capability.
Four practical examples
Illustrative scenarios, not reports of client mandates.
Exploited vulnerability
A manufacturer escalates a confirmed exploitation immediately and assesses the reporting clock.
Practical approach. The technical team should preserve the initial report, affected versions and assessment timeline. The legal reporting analysis should be recorded separately from the decision about the engineering fix.
Supplier component
A product uses third-party software; its contract requires rapid security information from the supplier.
Practical approach. A supplier agreement should define escalation channels and cooperation, not simply promise eventual notice. The customer needs information quickly enough to assess its own responsibilities.
Incident response
Legal and technical teams document awareness, assessment and notifications.
Practical approach. The incident map should identify potentially overlapping regimes and responsible contacts. A notification under one framework should not be assumed to satisfy every other applicable requirement.
Acquisition review
A buyer checks the target’s reporting process and product-security responsibilities before completion.
Practical approach. The buyer should review products, supplier dependencies, vulnerability records and the target’s reporting workflow. Findings should lead to a concrete remediation plan and appropriate transaction protection rather than a general statement that cybersecurity has been checked.
Next steps
Identify the affected group companies, products and contracts. Allocate responsibility for legal assessment and supporting documentation. Check the applicable provisions and transition rules before changing operational processes or giving commitments to counterparties.
Official source and further details
Discuss your business matter
Tell us which parties and countries are involved, what you want to achieve and whether a deadline is approaching. We will clarify the scope, the appropriate legal team and the fee arrangements before work begins.