Cyber law used to ask organisations to be secure. It now also asks them to report, quickly, to several authorities at once.

European Union

The reporting duties in the Cyber Resilience Act (Regulation (EU) 2024/2847) have applied since 11 September 2026. A manufacturer of a product with digital elements, hardware or software, must report an actively exploited vulnerability or a severe incident: an early warning within 24 hours, a fuller notification within 72 hours, and a final report afterwards. The duty covers products already on the market. Reports go through a single platform run by ENISA. The rest of the Act applies from 11 December 2027.

The NIS2 Directive is still arriving country by country. The Netherlands brought its implementing law into force in August 2026.

United Kingdom

The Cyber Security and Resilience Bill completed its report stage in the House of Lords on 26 October 2026, with the government defeated on two amendments. Royal Assent is expected between late 2026 and spring 2027, with most duties arriving around 2028. It widens the existing network security rules to more digital and managed service providers and to critical suppliers. Much of the detail, including reporting thresholds and time limits, will come in secondary legislation.

United States

The federal agency CISA sent its final incident reporting rule for critical infrastructure to the White House for review on 1 October 2026, after missing earlier dates. It is expected to be published by the end of the year. The proposed version required a report within 72 hours of a significant incident and within 24 hours of a ransomware payment. Whether the final text changes that is not yet known.

What this means

One incident can start several clocks: the product rules, the network security rules, financial services rules and the 72-hour personal data breach duty under the GDPR. They go to different authorities and ask for different things.

The first 24 hours are not the time to work out who has to be told.

Map the reporting duties now, name who makes each report, and rehearse it.

This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.