The Cyber Resilience Act clock doesn't stop for weekends
In a Help Net Security interview, Copla CEO Aurimas Bakas explains that the EU Cyber Resilience Act's 24-hour exploited-vulnerability reporting duty, in force since 11 September 2026, covers every product version still in use — not just what a manufacturer currently sells — and most boards are preparing for the wrong deadline.
In a Help Net Security interview, Aurimas Bakas, CEO of vulnerability-management vendor Copla, explained what the EU Cyber Resilience Act's reporting duties actually require of manufacturers — and why he thinks most companies are preparing for the wrong deadline.
Reporting obligations under Article 14 of the CRA started on 11 September 2026, with no end date: a manufacturer has to be able to send an early-warning notification within 24 hours of becoming aware that one of its products — including versions it stopped selling years ago — is being actively exploited. Bakas said most boards are instead focused on the CE-marking deadline in December 2027, because it reads like a project with a finish line.
Bakas said the obligation covers every product version still in use, not just what a company currently sells — comparing it to his experience in regulated finance, where banks asked what was running in their systems right now rather than what was being sold that year.
Missing the 24-hour window falls under the same penalty ceiling as the rest of the CRA — up to €15 million or 2.5% of global turnover.
His recommendation: build a register of every product version still in use and who runs it, before writing a reporting policy. Without knowing a customer is running a given version, a company has no way to warn them when it's exploited, and the 24-hour clock becomes impossible to meet.
He suggested boards test themselves with a concrete question: if told today that a flaw in a stopped-selling product is being exploited, could the company file an early warning by this time tomorrow — and can they name the person who would do it? He also recommended writing down, in one sentence, what "aware" means for the company's own incident process, before an incident forces the argument.
What happened
In a Help Net Security interview, Aurimas Bakas, CEO of vulnerability-management vendor Copla, explained what the EU Cyber Resilience Act's reporting duties actually require of manufacturers — and why he thinks most companies are preparing for the wrong deadline.
What changed
Reporting obligations under Article 14 of the CRA started on 11 September 2026, with no end date: a manufacturer has to be able to send an early-warning notification within 24 hours of becoming aware that one of its products — including versions it stopped selling years ago — is being actively exploited. Bakas said most boards are instead focused on the CE-marking deadline in December 2027, because it reads like a project with a finish line.
Who is affected
Bakas said the obligation covers every product version still in use, not just what a company currently sells — comparing it to his experience in regulated finance, where banks asked what was running in their systems right now rather than what was being sold that year.
Why it matters
Missing the 24-hour window falls under the same penalty ceiling as the rest of the CRA — up to €15 million or 2.5% of global turnover.
Response
His recommendation: build a register of every product version still in use and who runs it, before writing a reporting policy. Without knowing a customer is running a given version, a company has no way to warn them when it's exploited, and the 24-hour clock becomes impossible to meet.
What security teams should do
He suggested boards test themselves with a concrete question: if told today that a flaw in a stopped-selling product is being exploited, could the company file an early warning by this time tomorrow — and can they name the person who would do it? He also recommended writing down, in one sentence, what "aware" means for the company's own incident process, before an incident forces the argument.