When a Poorly Handled Vulnerability Becomes a Product Defect
Since 11 September 2026, manufacturers of products with digital elements (connected devices, software, embedded systems) have been subject to a new obligation under the Cyber Resilience Act (Regulation (EU) 2024/2847). This EU legislation is typically monitored by cybersecurity or regulatory compliance teams, rarely by the legal department handling litigation. Yet it connects directly to product liability law such that these two subjects should now be considered together.
The New Obligations Since 11 September
Article 14 of the Cyber Resilience Act, which took effect on 11 September 2026, requires manufacturers to report any actively exploited vulnerability in one of their products (for example, the interception of payment card data during a transaction on a poorly secured electric vehicle charging point, or unauthorised access to the video feed of a connected security camera, used to spy on the occupants of a property or to identify a prolonged absence). The timetable is strict: an initial alert within 24 hours, followed by a more detailed notification within 72 hours. These reports are submitted to ENISA (the European Union Agency for Cybersecurity, tasked in particular with centralising such notifications) as well as to the competent national CSIRT, that is, the national computer security incident response team (in France, CERT-FR, part of ANSSI). Reports are submitted through a platform common to all Member States, the Single Reporting Platform, developed and maintained by ENISA. In France, market surveillance under the CRA falls to the National Frequency Agency (ANFR), with technical support from ANSSI, a division of roles worth bearing in mind when an incident occurs. This obligation also covers products already placed on the market before 11 September, not only new products.
The 11 September deadline is only a first step: the bulk of the Cyber Resilience Act's compliance obligations (security-by-design requirements, technical documentation, CE marking) will not take effect until 11 December 2027. The reporting obligation, however, already applies.
The Direct Financial Risk: Fines of Up to €15 Million
Failure to comply with the reporting obligations under Articles 13 and 14 exposes a company to an administrative fine of up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher. This is the highest tier of penalty under the Regulation, on a par with non-compliance with essential cybersecurity requirements. The penalty scale has three tiers: €15 million or 2.5% for essential requirements and vulnerability-handling obligations; €10 million or 2% for other obligations under the Regulation; and €5 million or 1% for providing false or incomplete information to the authorities.
The Regulation provides for a derogation for SMEs and micro-enterprises: failure to meet the 24-hour deadline alone cannot form the basis of a penalty against them, although the underlying reporting obligation remains fully applicable. This derogation does not extend to large companies. Market surveillance authorities also hold a power distinct from financial penalties: they may order corrective action, a product withdrawal or recall, or restrict its availability on the market, measures whose operational and reputational impact can exceed that of the fine itself.
The Link with Product Liability, Too Often Overlooked
Directive (EU) 2024/2853 on liability for defective products, which applies from 9 December 2026, contains a point rarely commented upon: it expressly lists compliance with cybersecurity requirements among the criteria for assessing the defectiveness of a connected product.
A poorly handled vulnerability (a late report, the absence of a fix, prolonged silence in the face of a known flaw) is no longer merely a regulatory failing under the Cyber Resilience Act. It may now be relied upon by a consumer, or by an accredited association in a group action, as evidence establishing the defectiveness of the product for the purposes of civil liability.
A poorly handled cybersecurity incident thus exposes a company to two distinct and cumulative consequences: a regulatory penalty under the Cyber Resilience Act, and greater litigation exposure under product liability law. Addressing these two matters separately (one by the technical or compliance team, the other by the legal department) deprives the company of a complete picture of the risk actually incurred and how best to deal with it.
A CRA Notification Does Not Dispense With Either the GDPR or NIS2
A single security incident can trigger several distinct notification obligations, arising under different instruments, each with its own trigger, deadline and recipient. Reporting a vulnerability to ENISA under the CRA therefore does not remove the need to assess separately whether other applicable obligations have also been triggered.
The obligation to notify the CNIL (Article 33 GDPR) rests on a distinct criterion: the existence of a personal data breach, regardless of whether a product or a vulnerability is involved. An exploited vulnerability in a connected device therefore only triggers a GDPR obligation if it has actually compromised personal data, which is common, though not automatic, for this category of product. Where it has, both obligations apply cumulatively, on distinct legal bases and before distinct authorities.
For certain businesses, the NIS2 Directive adds a further layer of compliance complexity; its transposition into French law remains ongoing. This Directive imposes its own notification obligations to ANSSI, on a comparable timetable (alert within 24 hours, notification within 72 hours, final report within one month), but with a distinct scope: NIS2 regulates operators in critical sectors, regardless of the nature of the product concerned, whereas the Cyber Resilience Act regulates the products themselves, regardless of the manufacturer's sector. A company may therefore be subject to both instruments at once, in two different capacities.
Every security incident affecting a connected product therefore warrants an assessment against each of these instruments, rather than a single notification presumed to be sufficient.
Practical Tips
Four practical steps for any manufacturer or distributor of products with digital elements:
- Identify, internally, who is responsible for reporting. Poor organisation is often the leading cause of delay: check that a clear reporting line exists between the technical teams that may detect a vulnerability and those responsible for reporting it within the 24- and 72-hour deadlines.
- The reporting obligation is not limited to new launches: it also covers products already on the market before 11 September. An up-to-date inventory of your product range, together with known vulnerabilities associated with each product, avoids an unwelcome surprise on the day a flaw is discovered in an older product.
- Do your cybersecurity and legal teams genuinely communicate when a vulnerability is detected? A CRA report handled in isolation by the technical team, without informing the legal department, overlooks its potential bearing on the assessment of defectiveness under Directive 2024/2853.
- Keep a record of every report made and every fix applied. This documentation serves a dual purpose: demonstrating the manufacturer's diligence under the Cyber Resilience Act, and meeting the enhanced disclosure obligations under the product liability directive.
