The EU Cyber Resilience Act, which is now in effect (but not fully enforced until 2027/2028), has additional details and also includes a reporting requirement (articles 14, 15, and 16).