Every regulatory disclosure rule asks the same question. Each calls it something else

When I spoke about the EU regulatory landscape for banks and fintechs last year, I noted that the Cyber Resilience Act (CRA) had entered into force but would not legally apply until December 2027. That is still true for most of the CRA, but not for the framework’s reporting obligations. As of September 11, 2026, manufacturers of products with digital elements sold into the EU market have to report actively exploited vulnerabilities and severe incidents. These organizations are required to send an early warning to the European Union Agency for Cybersecurity (ENISA) and the relevant national Computer Security Incident Response Team (CSIRT) within 24 hours. This must then be followed by a more detailed notification within 72 hours, and a final report within 14 days for a vulnerability or one month for a severe incident. The new rule doesn’t just apply to new products, but to products already on the market as well. For most regulated organizations, that isn’t a new obligation, just a new disclosure clock added to a pile of existing ones. And if you’re a software vendor selling into highly regulated industries, it’s worse than that: Your notification is the event that also starts your customers' clocks.…