A 24-hour reporting clock started on connected water coolers today. Most POU operators cannot file one.

If this were my business, I would stop and make one call this morning. I would ask who here is legally able to file a security report by tomorrow. Most operators I know cannot answer that.

From today, 11 September 2026, a new EU duty applies. Makers of connected products must report a security flaw that is being actively exploited. The first warning is due within 24 hours. The European tool for filing that report opened this morning. The duty and the tool arrived on the same day. Nobody in this industry has filed a live report before.

What switched on this morning

The rule is Article 14 of the EU Cyber Resilience Act, Regulation (EU) 2024/2847. After the 24-hour early warning, a fuller notice follows within 72 hours. A final report is due 14 days after a fix is available.

Reports go through one website, the Single Reporting Platform, run by ENISA, the EU's cyber agency. The portal opens today, in English only.

The part that will catch operators out

To file anything, a named person needs a personal EU Login account with multi-factor security switched on. That person is registered as the Primary Assigned Representative. Only one person holds the role, and they can invite up to 20 colleagues once verified.

ENISA's own advice is to register only when you need to submit. So the paperwork and the emergency happen in the same hour.

Then the routing. You must pick the correct national response team, known as the coordinating CSIRT. ENISA says the wrong choice may invalidate the report. You then file again, with the clock already running. The list of teams for all 27 member states appeared on 4 September, one week before the start. A rule you can fail on a drop-down menu will produce failures.

No automation, so somebody types it

ENISA has confirmed there is no programming interface at launch. Every notification is typed in by a person. Automation may come later.

For a software firm with one product, that is fine. Now picture an operator with thousands of connected machines across several countries. It is a manual job on a 24-hour deadline.

One more detail matters. ENISA says the platform's 72-hour timer currently counts 48 hours from the moment you submit the early warning. Its own guidance notes that a report can therefore show as overdue before 72 hours have actually passed. The timer on the screen does not yet match the deadline in the law. Time your compliance from the moment you became aware. The countdown on the screen is running early.

Machines you sold years ago count

The design rules in the Act wait until December 2027. The reporting duty does not, and it reaches products already out in the field.

A connected cooler sold in 2019 and still reporting home is in scope today. There is one relief. Exploitation you already knew about before today needs no retrospective report. Find out tomorrow and the duty applies, even if the flaw is old news.

Connectivity just stopped being free

Here is the commercial point. The cost of this duty is mostly fixed per company. That makes it cheap per machine at scale and expensive per machine for a small operator.

You need a named representative and a way to spot an exploited flaw. You need a supplier contract that says when the factory must tell you. A group with 200,000 connected units spreads that over 200,000 units. An operator with 3,000 spreads it over 3,000.

Zenith's data makes the geography obvious. Connected hardware sits overwhelmingly in two fleets. One is mains-fed coolers, known in the trade as POU or point of use. The other is instant tap systems. Those two formats carry almost all of the growth in Western Europe. The markets furthest along that shift, the Nordics, Germany, the Netherlands and France, hold the most exposed hardware. The regulatory cost lands heaviest on exactly the markets the rest of the industry has been told to copy. We can see that because operators submit their own unit counts to us each year. Local data partners fill in the rest.

The bottled fleet has no filing duty

This is worth saying plainly, because the trade press rarely does. A bottled cooler with no data connection falls outside the definition of a product with digital elements. No Article 14 duty, no clock, no portal account.

That is a real advantage today, for the first time in about a decade. Bottled dispense is still the sensible answer on a factory floor or a rural site with weak mains. It is cheap to install and it earns money on every delivery. Now it also carries no cyber reporting exposure. Simple hardware has quietly become the low-compliance format.

None of that argues against converting. It argues for a compliance line in the conversion case that was not there last year.

What to watch next

Watch procurement. Large corporate and facilities tenders already ask about carbon and data handling. Expect a Cyber Resilience Act question in tender packs this winter. Operators who can show a named representative and a written process will take work from those who cannot.

ENISA must publish trend reports on what gets filed. The first is due within two years. By late 2028 there will be a public record of how connected product sectors behave under pressure. Dispense will be somewhere in it.

If you are buying an operator this year, add one line to the diligence list. Who is your Primary Assigned Representative, and when did they last do a dry run? A blank look is a price adjustment.

P.S. Trying to work out how much connected hardware actually sits in the markets you sell into? The 2026 Zenith Water Dispense Market Reports cover 30+ markets, every West and East European market plus Japan, Turkey, UAE, South Korea and Mexico on request. Each one is a full bottled, mains-fed and instant tap model: operators and shares, B2C and B2B split, revenue, and the outlook to 2030. Built on the world's largest water dispense database. Excel, with the written report on request: https://waterdispenseinsights.com/reports