## Reporting duties
What you must report depends on who you are and where you operate. From research dated 2026-10-31:

- **EU Cyber Resilience Act**: since 11 September 2026, manufacturers report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform: a 24-hour early warning, then a 72-hour notification.
- **UK NIS Regulations 2018** are in force for essential services and digital service providers. The deadline is not yet in our research, so it shows as open.
- **EU NIS2**: national laws differ by country; deadlines show as open until each country's law is checked.
- **UK Cyber Security and Resilience Bill**: not law yet. We'll update duties if it passes.
- **Defence contracts (DEFCON 658)**: carry the MoD Cyber Security Model terms; incident terms are not yet in our research.

Agents can draft reports. A named person approves every report before it is sent.