HelpAccount

Help: Reporting

Reporting duties

What you must report depends on who you are and where you operate. From research dated 2026-10-31:

  • EU Cyber Resilience Act: since 11 September 2026, manufacturers report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform: a 24-hour early warning, then a 72-hour notification.
  • UK NIS Regulations 2018 are in force for essential services and digital service providers. The deadline is not yet in our research, so it shows as open.
  • EU NIS2: national laws differ by country; deadlines show as open until each country's law is checked.
  • UK Cyber Security and Resilience Bill: not law yet. We'll update duties if it passes.
  • Defence contracts (DEFCON 658): carry the MoD Cyber Security Model terms; incident terms are not yet in our research.

Agents can draft reports. A named person approves every report before it is sent.

For agents: this help as Markdown.