Why it matters now: On September 11, 2026, the European Union flips a switch that industrial automation vendors have been dreading. The Cyber Resilience Act's first hard obligation begins enforcing mandatory disclosure of actively exploited vulnerabilities — and it covers every PLC, drive, HMI, and legacy controller already running on plant floors. For OT teams, this turns a long-simmering PLC patching backlog into a compliance and safety emergency.
Analyst Insight: The Cyber Resilience Act is not a distant 2027 problem. Article 14 reporting duties go live almost a full year before the broader product security rules, meaning the first wave of enforcement lands squarely on the industry's weakest capability: knowing what is running in the field and who must be told when it breaks.
The patch tsunami collides with the maintenance window
A PLC controlling a live polymerization reactor cannot be patched on a Tuesday night. A DCS managing a continuous distillation unit does not accept a firmware update simply because a vulnerability scanner flagged a critical CVE. In operational technology, the gap between vulnerability disclosure and active exploitation is shrinking, while the operational cost of unplanned downtime remains severe.
Compounding the problem, a large share of the installed base runs platforms that vendors no longer support. Windows XP and Windows 7 still power HMIs and engineering workstations, while legacy PLCs running firmware from the early 2000s receive no security updates at all. When a patch does exist, it must be validated by the OEM, tested against identical hardware, and squeezed into a narrow maintenance window that may arrive only once or twice a year.
Market Trends: Where direct patching is impossible, operators are shifting toward compensating controls — network segmentation, firewalling, application whitelisting, and virtual patching at the network edge. IEC 62443-2-3 provides the reference framework for formalizing these patch-management decisions, including documenting the rationale for any deferral.
Cyber Resilience Act: the 24/72/14 reporting clock
Under Article 14 of Regulation (EU) 2024/2847, manufacturers of products with digital elements must notify actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform (SRP). The clock starts the moment a manufacturer becomes aware of a triggering event — not when a fix is ready.
What are the exact CRA reporting timelines?
-
Early warning: within 24 hours of awareness — brief facts, affected product, and initial corrective steps.
-
Full notification: within 72 hours — substantive technical, assessment, and mitigation details.
-
Final report: within 14 days of a corrective or mitigating measure becoming available for vulnerabilities, or within one month for severe incidents.
Why legacy PLCs are squarely in scope
Manufacturers hoping legacy exemptions would spare them are mistaken. Article 69(3) explicitly overrides the "placed on the market before 2027" carve-out for Article 14 reporting. A product shipped in 2020 and never touched again still requires a working 24-hour reporting capability from September 2026.
This is the crux of the challenge identified by CSO Online: the same legacy equipment that is hardest to patch is also the equipment that must now be reported fastest. The maintenance window is measured in planned outages; the reporting window is measured in hours.
Which products fall under the reporting obligation?
Any product with digital elements placed on the EU market — including PLCs, remote I/O, HMIs, drives, sensors, and connected industrial software. The obligation applies to products already on the market, not just newly shipped devices. A single submission through the ENISA SRP simultaneously reaches the designated national CSIRT and ENISA.
What plant operators and OEMs should do now
September 2026 is a readiness checkpoint, not a product-redesign deadline. The practical work is procedural: know your field inventory, identify who holds the manufacturer role for each asset, and rehearse the 24-hour flow before a real incident forces you to learn it under pressure.
- Map the installed base and assign a responsible manufacturer party for each product family.
- Stand up a process for supplier security-advisory monitoring, ideally with contractual notification within 48 hours.
- Build a test bench of decommissioned but identical hardware to validate patches before deployment.
- Document every patching deferral with compensating controls and the IEC 62443-2-3 rationale.
Analyst Insight: The organizations that fare best after September 11 will not be the ones with the most aggressive patch cadence. They will be the ones with the fastest, most accurate incident-awareness chain — because under the Cyber Resilience Act, the first 24 hours are now a regulatory asset, not just an operational concern.
Frequently asked questions
Why can't legacy PLCs simply be patched like IT systems?
Legacy PLCs often run unsupported firmware, have no active vendor support, and cannot tolerate unplanned reboots or changes without risking safety and production continuity. Direct patching is frequently replaced by compensating controls — isolation, filtering, whitelisting, and continuous monitoring applied around the asset.
Does the Cyber Resilience Act require full product compliance on September 11, 2026?
No. The full product security requirements apply from December 11, 2027. September 11, 2026 activates only the Article 14 reporting obligations — triggered solely when a manufacturer becomes aware of an actively exploited vulnerability or a severe incident.
What happens if neither event occurs after September 2026?
If a manufacturer never becomes aware of an actively exploited vulnerability or a severe incident, no Article 14 action is required. The obligation is event-triggered, but the readiness to respond within 24 hours must already be in place.
