Cyber Resilience Act reporting obligations are now live, but the difficult question for manufacturers is not simply whether they have to report a cyber incident. It is what happens after the report has been made, while the incident is still developing.