Manufacturers selling software and connected products in the EU must report exploited flaws within 24 hours.