In force since 11 September 2026
Article 14: the reporting obligation that is already running
Most writing about the Cyber Resilience Act gives one date, 11 December 2027, and most teams have filed it under next year's problem. That is the wrong half of the timeline. The reporting obligations of Article 14 started on 11 September 2026, and they come with a 24-hour clock.
What triggers it
Two things, and only two. Article 14 of Regulation (EU) 2024/2847 obliges a manufacturer to report:
- an actively exploited vulnerability contained in a product with digital elements it has placed on the EU market, and
- a severe incident having an impact on the security of such a product.
Note the word actively. A vulnerability you discover in your own code, or one reported to you by a researcher, does not trigger Article 14 on its own. Evidence that someone is exploiting it does.
The obligation applies to products already on the market before the regulation fully applies. “We shipped it in 2024” is not an exemption.
The deadlines
| Deadline | What is filed | Contents |
|---|---|---|
| 24 hours | Early warning | That the vulnerability is being actively exploited, and the member states where the product has been made available, to the extent known. |
| 72 hours | Vulnerability notification | General information about the product, the nature of the vulnerability, and any corrective or mitigating measures taken or that users can take. |
| 14 days | Final report | A description of the vulnerability including its severity and impact, any malicious actor known to have exploited it, and the corrective measures made available. |
For a severe incident, the 24-hour and 72-hour stages are the same and the final report is due within one month.
The final report is due within 14 days of a corrective or mitigating measure becoming available. The clock on the first two stages starts when you become aware — not when you finish investigating, and not when you have a fix.
Where the reports go
To the CSIRT designated as coordinator for your member state, and to ENISA, through the Single Reporting Platform that ENISA has operated since 11 September 2026.
Which national CSIRT is yours depends on where you are established. There are twenty-seven of them, and the time to find out is not at hour one of a 24-hour window.
What this costs if you get it wrong
Article 64 puts non-compliance with the obligations in Articles 13 and 14, and with the essential requirements of Annex I, at the top tier: administrative fines of up to €15 000 000 or 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher.
What to write down, before you need it
Nothing in a repository or a policy document can prove that you would meet a 24-hour deadline. What it can show is that someone decided, in advance, who files and where. That difference is the whole of the preparation:
- Which CSIRT is yours, with the URL of its reporting channel and your ENISA Single Reporting Platform account.
- Who files — a named role, and a deputy. A 24-hour deadline with no named owner is not a procedure.
- What counts as “aware” for your organisation, so the clock has a defined start.
- Which products you have placed on the EU market, and their versions. You cannot report about a product you cannot enumerate.
- How this connects to your disclosure policy, so a researcher's report reaches the person who owns the regulatory clock.
All five belong in the same document as your coordinated vulnerability disclosure policy, which Annex I Part II(5) requires anyway.
Check what your repository can currently evidence
cra-ready is a free, open-source checker. It reads a
repository and reports the CRA obligations it cannot evidence — the
Article 14 procedure among them — each mapped to its article or annex
point and to the date it becomes enforceable.
npx cra-ready ./your-projectZero dependencies, nothing leaves your machine.
The rest of the timeline
Article 14 is the only obligation binding manufacturers today. The essential requirements of Annex I, conformity assessment, CE marking and the technical documentation all apply from 11 December 2027. The Cyber Resilience Act overview sets out what lands when, and what each obligation asks for.
This page is a summary of a regulation, written to be useful, not a substitute for reading it. It is not legal advice. Whether the CRA applies to your product, which class it falls in under Annex III or Annex IV, and how to answer a market surveillance authority are questions for a professional.