After the attack: Europe's clock starts at 24 hours. The US clock depends on the sector.

A maker learns that attackers are using a flaw in its robots. How long before someone official has to know?

In Europe, the answer started on 11 September 2026. That's 47 days ago. Article 14 of the Cyber Resilience Act sets the clock for an actively exploited vulnerability:

within 24 hours of the manufacturer becoming aware of it

That's the early warning. A fuller notification follows within 72 hours. A final report is due "no later than 14 days after a corrective or mitigating measure is available". A severe incident runs on the same 24 and 72 hours. Its final report is due within one month.

Does this reach robots? Most connected ones, yes. The Act covers products with a data connection. Products under the EU medical-device and vehicle type-approval rules sit outside it. Its Recital 53 tells machinery makers to "comply with both" this Act and the Machinery Regulation. It also reaches products already sold. Article 69(3) applies the reporting duty to products placed on the market before 11 December 2027.

In the US, there's no single clock. It depends on the sector.

Vehicles: the maker files a defect report "not more than 5 working days" after it decides the defect is safety related. That clock starts at the decision, not at the first sign.

Medical robots: section 524B requires a plan to "monitor, identify, and address" vulnerabilities "in a reasonable time". It sets a process, not a fixed hour count.

Critical infrastructure: the 2022 reporting law sets 72 hours. It isn't in force. CISA says no reports are required until the final rule takes effect.

For a physical AI, why does the clock matter? Because an exploited flaw in a robot is a live hazard, not a leak. A short clock means the authorities hear within a day that a machine may not obey.

Here's the honest limit. The Act doesn't define "becoming aware". Every European clock starts at that phrase.

Bottom line: Europe = 24 hours, for most connected products. The US = it depends who regulates you.

Robot makers: who on your team owns the 24-hour clock?

Part 8 of 12 · When the AI drives the motor: Physical AI cybersecurity as a safety problem.