Remote maintenance:
Manufacturers report to ENISA, operators to the BSI
Video · 0:36 min · November 9, 2026
Since 11 September, manufacturers of gateways, routers and service tools must report actively exploited vulnerabilities to ENISA within 24 hours. Operators covered by the new German BSI Act report significant incidents with the same deadline to the BSI, Germany's Federal Office for Information Security. The service provider in between is not automatically obligated, so the reporting route belongs in the service contract.
In the video
- 01The manufacturer reports the vulnerability to ENISA. An incident at the operator goes to the BSI.
- 02The BSI Act has applied since December 2025, the CRA reporting obligation since September, and the rest from December 2027.
- 03Manufacturing is the most frequently registered sector, ahead of health and energy.
- 04From December 2027, every security update must stay available for at least ten years.