Must a manufacturer report exploited vulnerabilities in its products?

Manufacturer

Manufacturers of products with digital elements placed on the EU market.

Yes, actively exploited vulnerabilities and severe incidents must be notified.

Notify the CSIRT coordinator and ENISA through the single reporting platform and inform users.

high (fine_cap_pct_turnover)

1. Monitor products for exploited vulnerabilities
2. Send the early warning
3. Send the vulnerability notification
4. Inform affected users

Early warning within 24 hours and notification within 72 hours of becoming aware; the obligation applies from 11 September 2026.

• Regulation (EU) 2024/2847, Art. 14
• Regulation (EU) 2024/2847, Art. 64(2)
• Regulation (EU) 2024/2847, Art. 71(2)

sha256 cae79650fa5b4ed40a7c70ff3b71d7bcfca56e8aba59a9258e71e3bdb2f6fb08 · read 2026-10-15 · Source: NovaCopilot

• What must we report under NIS2 after a cyber incident?

• agent:eu:business:nis2-incident-reporting (business_agent)