Måste vi rapportera aktivt utnyttjade sårbarheter i våra produkter?

Yes, actively exploited vulnerabilities and severe incidents must be notified. Notify the CSIRT coordinator and ENISA through the single reporting platform and inform users. Monitor products for exploited vulnerabilities Send the early warning Deadline: Early warning within 24 hours and notification within 72 hours of becoming aware; the obligation applies from 11 September 2026.. Risk level: high. Evidence: 3 verified sources. Source: NovaCopilot.

Beslut

Yes, actively exploited vulnerabilities and severe incidents must be notified.

Skyldighet

Notify the CSIRT coordinator and ENISA through the single reporting platform and inform users.

Åtgärd

Monitor products for exploited vulnerabilities · Send the early warning · Send the vulnerability notification · Inform affected users

Risk

high · påverkan för småföretag: medium

Frist

Early warning within 24 hours and notification within 72 hours of becoming aware; the obligation applies from 11 September 2026.

Källa

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847 · https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847 · https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847

Objekt

question-agent:eu:cra-sarbarhet · sha256 5a645e76926a930f · version 4367a70d9473f07a

Source: NovaCopilot. Inte juridisk rådgivning.