EU Cyber Resilience Act 24h rule starts in four weeks with 76% of vendors missing security.txt

The EU Cyber Resilience Act’s Article 14 imposes a 24-hour deadline for reporting actively exploited vulnerabilities, starting 11 September 2026. This rule applies retroactively to all products with digital elements, including those placed on the market before December 2027. The most common trigger for awareness is a security researcher attempting to report a vulnerability privately. However, 76% of 623 scanned EU software vendors lack the RFC 9116 security.txt file, which provides a standardized contact method for such reports. Without this file, researchers may resort to public disclosure or notifications via CERTs, forcing vendors into compliance under suboptimal conditions.

The scan methodology targeted 623 European software vendors listed on europealternatives.com, excluding 131 unreachable domains. Only 24% of reachable domains had a valid security.txt file, defined as an HTTP 200 response with a Contact: field. While some vendors may use alternative channels like bug-bounty platforms or published security emails, the scan specifically measured RFC 9116 adoption. The absence of security.txt does not preclude other reporting methods, but it removes a low-effort, widely recognized standard that reduces friction for researchers. Vendors relying on non-standard channels may still face delays or missed reports, increasing the risk of public disclosure.

The 24-hour reporting window under CRA Article 14 is unforgiving, and the lack of a security.txt file exacerbates the risk of non-compliance. When a researcher cannot report a vulnerability privately, they may escalate to public disclosure or notify a CERT, which triggers the 24-hour clock. This leaves vendors with minimal time to assess, validate, and report the issue, increasing the likelihood of errors or incomplete submissions. The scan’s findings suggest that most EU software vendors are unprepared for this requirement, despite the rule’s imminent enforcement. Correcting this gap is technically simple, adding a security.txt file takes minutes, but the operational and legal consequences of inaction are significant.

The scan’s limitations include its focus on European SaaS and software vendors, which may not represent all EU manufacturers. Additionally, the methodology excluded unreachable domains and did not account for vendors using non-standard reporting channels. However, the results highlight a broader issue: the lack of adoption of a low-cost, high-impact security standard. Vendors that fail to implement security.txt risk not only regulatory penalties but also reputational damage from public disclosures. The CRA’s retroactive application to pre-2027 products means even long-standing software is subject to the rule, making immediate action critical for compliance.