If you make connected devices or software sold in the EU, this changed on 11 September 2026: an actively exploited vulnerability has to be reported within 24 hours. It's the Cyber Resilience Act, and it also covers products already on the market.
A · IoT or smart devices
B · software inside a connected product
C · pure SaaS only
Write your letter, I'll reply to everyone.




