Let’s talk about the clock that starts tomorrow.
On 11 September 2026, the reporting obligations inside the EU’s Cyber Resilience Act begin to apply. In plain language: from tomorrow, if a vulnerability in a connected product is being actively exploited, the manufacturer has twenty-four hours to raise an early warning. Within seventy-two hours it has to file the fuller notification. And it has to tell the people using the product about the problem and what to do about it, without delay.
That is genuinely good law. It is the first time a machine’s failure has been given a legal timestamp, an owner, and an address to report to. I’ll take that. Most of what we argue about in this space is promises. This one has a clock on it.
Now the part nobody is talking about.
Picture a house on a Tuesday night. There’s a camera on the wall, a router in the passage, maybe a continuous glucose monitor on a kid’s arm. At 02:14 someone, somewhere, works out that the firmware in one of those devices can be walked straight through and is being walked straight through right now.
The person asleep in that house is the point of the whole event. They are also the last person to hear about it.
Here is what actually happens inside those twenty-four hours. A security team gets an alert. They triage it. They argue about whether “actively exploited” is the right phrase for what they’re seeing, because that phrase is the trigger and the trigger has legal weight. Somebody drafts. Somebody senior signs. The filing goes to a national computer emergency response team, into the EU’s single reporting platform. Somewhere in the middle of that, a notice gets written for users, and that notice is the last thing on the list, because it’s the only piece with no regulator waiting on it.
So the report that matters most to the human being affected — the one attached to the broken thing — is the one with the softest deadline and the most careful wording.
That is not a conspiracy. It’s just what the incentive produces. Regulators have deadlines and names. Users have patience.
There’s a second thing in here, and it’s the thing I’d push on if I were writing the rules. The law gives you the discretion to decide what happened. Twenty-four hours is not a long time to be honest about your own product, but it’s a very comfortable amount of time to be careful about your own language. Which means the interesting variable was never the deadline. It’s who in that room holds the pen.
Think about the old way for a second. Before all of this, a company that found a catastrophic flaw in something it sold had three real options. Fix it quietly, sit on it and hope, or say something. Two of those three were free. Sitting on it cost nothing because nobody would ever see the decision to sit on it. That is over now — not because companies got braver, but because silence has started to become a document with a timestamp on it, and documents can be audited.
That’s the shift. The machine’s silence stopped being a business judgment and became an offence.
Good. But notice what we still don’t get. The filing exists. The regulator can read it. ENISA can read it. The national team can read it. And the person whose insulin pump is on that list gets a notice that says a vulnerability was identified, a mitigation is available, and thank you for your patience. They never see the record. They see the summary of the record, written by the party that has every reason to keep the summary short.
If you build connected products, this is your problem from tomorrow, and you should treat it like one before it becomes one.
Three things, quickly. First, your incident response is now a writing problem. The engineering is not the bottleneck. The bottleneck is having a pre-approved sentence, a named signatory, and a user notice that was drafted while things were calm, because at 02:14 on a Tuesday nobody writes a clear paragraph about their own product being unsafe.
Second, decide now who holds the pen inside the twenty-four hours. If it defaults to legal, you will produce a document that satisfies a regulator and teaches your customer nothing. If it defaults to comms, you produce something warm and useless. Someone has to own both the accuracy and the plainness.
Third — and this is the one that pays — treat the user notice as the primary document, not the appendix. The regulator’s copy is your legal exposure. The customer’s copy is your reputation, and reputation is the only one of those that compounds.
Now back to the house on Tuesday night.
The deeper thing hiding under this deadline is not about cybersecurity at all. It’s about standing in relation to the systems you depend on. We have spent twenty years getting comfortable with the idea that we don’t really know what’s inside the devices around us, and that the people who do know have no real obligation to tell us anything promptly. That arrangement has been quietly pricing risk onto the human at the end of the chain — the one with the least information and the most to lose.
A twenty-four-hour clock is a start. It’s a real start. But a clock that only runs toward a regulator still leaves the human outside the room while the decision about their own safety gets made.
So the principle I’d hold onto here is simple enough. If the machine in your life gets broken into, you belong inside the first twenty-four hours. Not at the end of them. Not summarised. Not handled. Informed — early, plainly, and by someone who had to write it down before they knew how it would read.
The law just learned how to put a timestamp on a machine’s failure. The next thing it has to learn is that the timestamp belongs to the person, too.
That’s tomorrow’s problem. And it’s already started.