EU starts 24-hour AI vulnerability clock

From 11 September, the EU’s Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities and severe incidents in covered digital products, with an early warning due within 24 hours, a full notification within 72 hours, and a final vulnerability report within 14 days of a fix, the European Commission’s reporting guidance says. For teams shipping AI software that falls within the Act’s digital-product scope, this is a reporting clock—not the full CRA compliance deadline, which arrives later. Connect incident response to product reporting now, alongside the site’s analysis of shrinking exploit windows.