Komplyo blog

Incidents and vulnerabilities

A single incident can fall under several notification deadlines: 72 hours under the GDPR, 24 hours for the NIS2 early warning, 24 hours under the CRA for a vulnerability under active exploitation. These articles set out the triggers, the recipients and the expected content of each notification, along with the coordinated vulnerability disclosure policy.

July 22, 20265 min read

CRA: the 24-hour and 72-hour notification obligation applies on 11 September 2026

Article 14 of Regulation (EU) 2024/2847 applies on 11 September 2026, fifteen months ahead of the rest of the CRA. Early warning within 24 hours, notification within 72 hours, final report within 14 days or one month, through ENISA's single reporting platform. What a manufacturer, including an SME software vendor, must have in place.

CRA
EU regulation
Incident response
NIST CSF

Read article →

Get the security policy template

An information security policy template in .docx format, structured around NIST CSF 2.0 and ISO 27001. Delivered by email, usable as a documentation baseline.

Measure your security maturity →