EU Router Reporting Rules: What Changes From September 2026

Technology8 min read

Verdict: 11 September 2026 did not make the router in your home safer overnight. It required manufacturers to enter the reporting process sooner when they learn that a vulnerability is being actively exploited or that a serious incident has occurred. The patch, customer alert and length of support remain separate questions.

Hypothetical scenario: a router manufacturer discovers credible evidence that an attacker has taken control of devices in a particular model. Within no more than 24 hours of becoming aware of it, the manufacturer must submit an early warning; within no more than 72 hours, a more detailed notification. However, the router owner does not automatically receive new firmware within that period, nor is it guaranteed that they will immediately see a public announcement. These deadlines are for reporting, not fixing. enisa.europa.eu

Three clocks not to confuse

Clock	What starts running	What it means for you
24 / 72 hours	Initial reporting after the manufacturer learns of an actively exploited vulnerability or a serious incident.	It is not a patch deadline and not a promise of individual notification.
Unknown time to mitigation	The investigation, development, testing and deployment of a fix or temporary measure.	There may be an update, a configuration recommendation or, for a discontinued model, no remedy available.
11 December 2027	General application of the CRA regime to new products that fall within the scope of the regulation.	It does not retroactively turn every old router into a product with new support.

The Cyber Resilience Act explicitly separates these points in time. The reporting obligations in Article 14 became applicable on 11 September 2026, while the regulation’s general application is set for 11 December 2027. For actively exploited vulnerabilities, the final report is due no later than 14 days after a corrective or mitigating measure becomes available; for serious incidents, the deadline is one month from the initial 72-hour notification. enisa.europa.eu

Why not every CVE triggers the 24-hour rule

A high-severity vulnerability can be serious and may require an urgent update. But not every CVE, bug or misconfiguration automatically falls under the mechanism launched in September.

For more information on cybersecurity, see also The Claude–OpenAI case shows where AI agents compress an attack: not at the password, but between breaches, which provides complementary details on this topic.

The threshold is more specific: there must be reliable evidence that a malicious actor has exploited the vulnerability without the system owner’s permission. In other words, the difference is between “there is a problem that could be attacked” and “there is evidence that the problem is already being used in an attack”. enisa.europa.eu

This boundary avoids a mistaken conclusion: not having seen a European alert about your model does not prove that the router is safe. There may be no known active exploitation, the issue may not fall within the scope of reporting, or the information may not be made public immediately.

What happens after notification — briefly

The manufacturer submits the notification through ENISA’s Single Reporting Platform and selects the relevant designated coordinating CSIRT. The information reaches ENISA at the same time, and the CSIRT may further distribute the data to other relevant teams and, where necessary, to supervisory authorities. The platform protects the confidentiality of the information; it is not a real-time public catalogue of all vulnerable gadgets. enisa.europa.eu

For Romania, ENISA’s list of designated CSIRTs identifies DNSC. This is a useful institutional reference point, not a reason to assume that a router owner must file the legal notification in place of the manufacturer. The current version of the platform is intended for manufacturers’ mandatory notifications; people who are not manufacturers are directed to contact the relevant national CSIRT to report an issue. enisa.europa.eu

Your router decision: keep, isolate or replace

Do not start with the question, “Is it covered by the CRA?” Start with evidence about the exact device. You need the full model number, hardware revision if there is one, firmware version, official support page and, ideally, a clear indication of when support ends.

Verdict	Minimum evidence	What to do now
Keep and update	The model appears in official support materials; current firmware or automatic updating is available; there is no official announcement that support has ended.	Install the latest official version, change the administrator password if it is weak or reused, and turn off remote administration unless you have a genuine reason to use it.
Temporarily isolate and plan a replacement	Support is uncertain, the latest firmware is old, or the manufacturer does not provide a clear answer; the device nevertheless has a limited role.	Reduce exposure: disable internet-based administrative access, stop using it as the central device for work or sensitive devices, and move IoT gadgets to a separate network where possible.
Replace as a priority	Support has ended or official firmware is no longer available; the router serves the main network; the administration interface is or has been exposed to the internet.	Do not wait for a European reporting obligation to retroactively create a patch. Choose a model with documented support, automatic updates and clear remote-administration options.

The practical threshold: a router without confirmed support, at the centre of the home network, deserves to be treated as a priority even if there is no public alert about it. A router is not legally “more important” than other products simply because of its name, but it matters in practice because it carries traffic for many devices.

The common case: a router provided by your operator

This is where the most common confusion arises: the manufacturer named on the label may not be the party that delivers firmware to you. The operator may manage updates, configuration or replacement of equipment supplied as part of the subscription.

Before concluding that the device has been abandoned, check two places: the local interface or app associated with the equipment, and the operator’s support channel. Ask explicitly whether the firmware is managed by the operator, whether the equipment still receives updates, and how to request a replacement. If you cannot control updates, that does not automatically mean there is no support; it means that the evidence must be requested from the service provider.

What to check in 10 minutes, without relying on promises

Identify the exact model. Do not note only the brand: record the model, hardware revision and firmware version.
Check the official source. Look for the support page, firmware history, security advisories and any end-of-life or end-of-support announcement.
Check internet access. If you do not need remote administration, disable it. Do not install firmware received through links in emails, text messages or social media posts.
Separate higher-risk devices. A guest or IoT network does not fix a vulnerable device, but it can limit what a compromised camera, smart plug or robot vacuum can reach.
Document the response. For an operator-provided router, keep the request number and the response about firmware or replacement. For a purchased router, keep the support page and the installed version.

What to ask before buying your next router

From 2027, the CRA will change requirements for new products within its scope. But when buying, the best question remains simple: what verifiable support will I receive for this model?

Is the support period or estimated end-of-support date communicated?
Is there a public history of firmware and advisories for older models from the same brand?
Can automatic updates be enabled and verified?
Is remote administration a clear option that you can disable?
Is there a vulnerability-reporting channel and security documentation?

Wi-Fi 6, 6E or 7 may matter for speed and capacity, but the radio standard is not a guarantee of security support. A router that is new technologically but has unclear updates may be a weaker choice than a less spectacular model that is transparently maintained.

The conclusion that matters

The change of 11 September 2026 is real: when an active exploit or serious incident comes to a manufacturer’s attention, it now has a mandatory reporting timetable through European infrastructure. This may improve the coordination of a response when an attack is already real; there is not yet a sufficient public basis for measuring the practical effect on users in Romania.

Home security is not decided on ENISA’s platform, nor by the mere existence of a future CE marking. It is decided first by a verifiable fact: is the manufacturer or operator still delivering and documenting support for the model you use?

Frequently asked questions

Will I receive a patch within 24 hours if my router is affected?

No. The 24 hours concern the early warning that the manufacturer must submit after learning of an actively exploited vulnerability or a serious incident. The time to a fix depends on investigation, development, testing and whether the model is still supported.

Do I have to report my router’s vulnerability through the ENISA platform?

No. The obligation under Article 14 of the CRA lies with the manufacturer. In its current version, ENISA’s platform is for manufacturers’ mandatory notifications. If you are not a manufacturer and notice an issue, ENISA recommends contacting the relevant national CSIRT or using the manufacturer’s security channel.

If I cannot find a public alert about my router, does that mean it is safe?

No. The European platform is not a complete public register of vulnerable devices. The absence of an alert may have several explanations and does not replace checking the firmware, advisories and support status for the exact model.

What should I do if the router was provided by my internet operator?

Check whether updates are managed by the operator and request an explicit response about firmware support, security updates and the replacement procedure. The manufacturer’s label does not always say who actually delivers updates to the customer.

Does the CRA mean every router will receive five years of updates?

No. It is not correct to present the CRA as a uniform, already applicable five-year promise for all routers. For a specific product, look for the support period communicated by the manufacturer or, for equipment supplied as part of a subscription, by the operator.