CRA Article 14: what you must report, and by when

Who must report

Article 14 addresses manufacturers and covers two events: an actively exploited vulnerability in your product (Art. 14(1)) and a severe incident having an impact on its security (Art. 14(3)).

Three questions. If all three are yes, Article 14 applies to you.

• ✓You place hardware or software with a digital element on the EU market, under your own name or brand.
• ✓It is not already covered by sector rules that displace the CRA, such as medical devices, civil aviation or type-approved vehicles.
• ✓You still support it after 11 September 2026. Products you sold years ago count too (Art. 69(3)).

Article 69(3): the reporting duties also apply to products placed on the market before 11 December 2027, so a product you still support is in scope however old it is. Being established outside the EU does not remove the duty; it changes which coordinating CSIRT receives the notification.

The three deadlines

• Early warning. Art. 14(2)(a) and 14(4)(a). Says that it happened, in which Member States the product is available, and whether unlawful or malicious acts are suspected.
• Notification. Art. 14(2)(b) and 14(4)(b). The nature of the exploit or incident, the measures you took, the measures your users can take, and a sensitivity assessment.
• Final report. Art. 14(2)(c): within 14 days of a corrective or mitigating measure being available. For severe incidents: within one month of the 72-hour notification.

Goes to: the CSIRT designated as coordinator in your Member State, and ENISA.

Awareness, not CVE publication

All three deadlines hang off one instant: when you become aware. Not detection, not the day the CVE was published, not the day the fix shipped.

Commission guidance C(2026) 5252 §213: you become aware when, after an initial assessment, you have a reasonable degree of certainty that the vulnerability is actively exploited or that a severe incident has occurred. §214 requires that assessment to be prompt.

A listing on CISA KEV or the ENISA EUVD exploited list usually starts that assessment; it does not end it, because you still have to confirm the vulnerable code is present and reachable in your product.

The portal's 72-hour counter and the legal clock

ENISA FAQ Q26: the platform's 72-hour counter shows a due time 48 hours after your early-warning submission. File the early warning promptly and the portal flags you as overdue before the legal 72 hours are up. Since 21 October 2026 the vulnerability form has a mandatory awareness field (glossary v1.6), and ENISA has said a later release will count from awareness.

Become aware at 09:00 Monday and file the early warning at 17:00 Monday: the portal flags the notification as overdue from 17:00 Wednesday, while Art. 14(2)(b) gives you until 09:00 Thursday.

Work to the legal clock and treat the portal's counter as a reminder; state the awareness time in words in your summary, and keep your own dated record of it. Deadline Check: enter your two instants and see both due times.

Filing on the Single Reporting Platform without an API

"No Application Programming Interface (API) will be provided at the initial release of the SRP, so notifications must be submitted through the platform interface."

In practice your Assigned Representative logs in with EU Login and multi-factor authentication and fills in the form. Each manufacturer registers one Primary Assigned Representative and up to 20 Secondary Assigned Representatives. You can file up to 20 notifications before your Assigned Representative is validated, so registering today does not hold anything up.

An email to a CSIRT is a fallback for when the platform is down, not a formal notification (NCSC Ireland, national CRA guidelines, August 2026). Every field the platform asks for, with its limit and its status at each stage, is on the SRP field reference.

Informing your users

Art. 14(8): after becoming aware, and where appropriate, you inform the impacted users without undue delay about the vulnerability or incident and, where necessary, about risk-mitigating and corrective measures they can take. This runs alongside the notifications and does not wait for the 72-hour filing.

Commission guidance C(2026) 5252 §§219–221: what you tell users, and how, is risk-based and proportionate. A CSAF 2.0 advisory plus a human-readable notice is the common form; the Regulation prescribes neither and sets no fixed hour.

Penalties and the small-enterprise exemption

Art. 64(2) puts the Article 13 and 14 obligations, including reporting, in the tier up to €15M or 2.5% of worldwide annual turnover. €10M or 2% (Art. 64(3)) applies to other economic-operator duties. Micro and small enterprises are exempt from fines for a missed 24-hour early warning (Art. 64(10)); the obligation itself still applies.

What you already knew before 11 September

Exploitation you already knew about before 11 September does not have to be reported retroactively (Commission guidance C(2026) 5252 §217). Everything you learn from now on does.

The dividing line is awareness of exploitation, not the age of the vulnerability: learning after 11 September 2026 that a long-known vulnerability is now actively exploited is new awareness.

Official sources

• Regulation (EU) 2024/2847 on EUR-Lex: English · Deutsch
• Commission guidance C(2026) 5252 on the reporting obligations
• ENISA Single Reporting Platform: frequently asked questions
• ENISA Single Reporting Platform: the portal

This page is not legal advice. It follows the Regulation and the Commission's guidance and cites the source for every rule; the dated record of changes is the Regulatory changelog. Your filings remain your legal statements, and you should have them reviewed.