The 24-Hour Clock Just Started Ticking — And Most Boards Don't Know It

Last Thursday, September 11, a regulation took effect that most American boardrooms have never discussed. The European Union's Cyber Resilience Act began enforcing its vulnerability reporting obligations, and any company that sells a product with a digital component into the EU market is now on a 24-hour clock.

Not a 30-day clock. Not a "reasonable timeframe." Twenty-four hours from the moment a manufacturer becomes aware that a vulnerability in its product is being actively exploited, it must file an early warning with ENISA — the EU's cybersecurity agency — through a newly launched Single Reporting Platform. A fuller technical notification follows within 72 hours. A final report is due within 14 days.

If that timeline sounds aggressive, consider what it means in practice. Microsoft released its September Patch Tuesday update on September 8 — three days before the CRA reporting clock started — addressing 973 vulnerabilities across Windows, Office, SQL Server, Exchange, and Azure. Two of those were actively exploited zero-days. One hundred thirteen carried a critical severity rating. That single vendor, in a single month, disclosed nearly a thousand flaws. Now multiply that across every manufacturer selling digital products into the EU.

This Is Not a European Problem

American executives might be tempted to file this under "EU regulatory overhead" and move on. That would be a mistake.

The CRA applies to any manufacturer placing products with digital elements on the EU market, regardless of where the company is headquartered. If your firm sells software, connected devices, or any product with an embedded digital component to EU customers, you are in scope. The reporting obligation covers products already on the market — not just new ones shipped after September 11.

The penalty structure removes any ambiguity about how seriously the EU takes this. Failure to comply with the core cybersecurity requirements or reporting obligations can result in fines of up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher. For a company doing €1 billion in revenue, that ceiling is €25 million. Secondary violations carry fines of up to €10 million or 2% of global turnover.

What Boards Need to Ask This Week

If you sit on a board or report to one, the CRA demands a conversation that many organizations have not had. Here are the questions that matter:

Do we sell anything with a digital component into the EU? The definition is broader than most executives expect. It covers not just software products, but hardware with embedded firmware, IoT devices, and connected industrial equipment. If the answer is yes — or even "we're not sure" — you have a compliance gap that is already live.

Can we actually meet a 24-hour reporting window? Most organizations struggle to detect an intrusion within days or weeks, let alone confirm that a specific vulnerability is being actively exploited and file a structured report within 24 hours. This is not a communications exercise. It requires pre-built detection, assessment, and reporting workflows.

Who owns this? The CRA's reporting obligations sit at the intersection of engineering, legal, and security. If no one in your organization can name the person responsible for filing a CRA notification, you are already behind.

The Compliance Trap

Here is where the CRA intersects with a problem I explore throughout Cyber Risk Is Business Risk: the difference between compliance and security. A board that treats the CRA as a checkbox exercise — "we set up the ENISA portal account, we're done" — misses the point entirely.

The 24-hour reporting requirement is a forcing function. It assumes that manufacturers have real-time visibility into how their products are being attacked. It assumes they can assess whether a vulnerability is being actively exploited, not just theoretically exploitable. It assumes they have the internal coordination to move from detection to disclosure in a single business day.

Most organizations cannot do any of this today. The CRA does not care.

This is the pattern I see again and again in my work advising executive teams: a regulatory mandate arrives, the compliance team scrambles to meet the letter of the law, and the underlying security capability that the regulation was designed to force into existence never actually gets built. The organization becomes compliant on paper and exposed in practice.

The Three Questions framework I lay out in the book applies directly here. Before you worry about the reporting timeline, ask: What do we have? What can go wrong? What are we doing about it? If your organization cannot answer those questions for every product it sells into the EU, the CRA filing portal is the least of your problems.

The Convergence With U.S. Requirements

The CRA does not exist in a vacuum. The SEC's cybersecurity disclosure rules already require U.S. public companies to report material cybersecurity incidents within four business days. The SEC's amended Regulation S-P — with its June 2026 compliance deadline for smaller firms — expanded obligations around how financial institutions handle customer data after a breach.

For any company operating across both markets, the message is clear: the regulatory floor is rising on both sides of the Atlantic, and the organizations that treat each mandate as an isolated compliance project will spend more money and get less security than those that build a unified capability for detection, assessment, and disclosure.

The NACD's 2026 Director's Handbook on Cyber-Risk makes this explicit: nearly nine in ten Russell 1000 companies now disclose board-level oversight of cybersecurity. The question is no longer whether boards are paying attention. It is whether their oversight is substantive enough to drive the operational readiness that regulations like the CRA demand.

What to Do Now

If you are a board member, executive, or CISO reading this, here is what I would prioritize this week:

Scope your exposure. Map every product your company sells or distributes into the EU that includes a digital component. If that mapping does not exist, that is your first deliverable.

Pressure-test your response time. Run a tabletop exercise with a simple scenario: a zero-day in one of your products is being actively exploited. Can you confirm it, assess it, and file a structured report within 24 hours? If the answer is "we'd need to figure that out," you have your answer.

Designate ownership. Someone in your organization needs to own CRA compliance the way someone owns SEC disclosure. This is not a part-time job.

Connect the dots. If you are already building incident response workflows for SEC four-day materiality determinations, extend them. The CRA's 24-hour window is tighter, but the underlying capability — detect, assess, disclose — is the same muscle.

The 24-hour clock is not a theoretical exercise. It started ticking four days ago. The only question is whether your organization heard the alarm.