Do I have to report a vulnerability in my software?

Yes, if you commercially sell software or devices with digital elements in the EU and learn that a vulnerability is being actively exploited: early warning within 24 hours, notification within 72 hours, final report 14 days after the fix, through the ENISA platform. Applies from 11 September 2026.

Who must?

Manufacturers of software and devices who commercially place them on the EU market, wherever they are based. Free open source without commercial activity is out of scope.

What to do?

1. Keep a list of components (SBOM) and a daily vulnerability check.
2. When you learn of an actively exploited vulnerability, write down the moment you learned of it: the clock starts.
3. Early warning within 24 h, notification within 72 h, final report 14 days after the fix, all through the ENISA platform; inform your users.

Where to file?

ENISA Single Reporting Platform (the manufacturer reports).

Who checks?

ENISA and the national CSIRT

Fine

Up to 15 million € or 2.5 % of annual turnover for the essential requirements and the obligations in art. 13 and 14; up to 10 million € or 2 % for other obligations (art. 64).

We are confirming the amount in the source before we publish it.

What if I am already late?

Report right away, even late; note when you learned of it and why it was late.