From 11 September 2026, CRA reporting obligations require manufacturers to file an early warning within 24 hours of becoming aware that a product is being actively exploited. The regulation measures awareness, not exploitation — and for most organisations, awareness is the part that’s not ready.