What Article 14 asks for
- Actively exploited vulnerability (Article 14(2)(a)): an early warning without undue delay and in any event within 24 hours of becoming aware. It indicates, where applicable, the Member States where you are aware the product with digital elements has been made available.
- Severe incident (Article 14(4)(a)): an early warning without undue delay and in any event within 24 hours of becoming aware. It includes at least whether the incident is suspected of being caused by unlawful or malicious acts, and also indicates, where applicable, the Member States where you are aware the product has been made available.
That is narrower than the 72-hour notification. The fuller details come next.
This page does not describe an official submission form. Use what ENISA's Single Reporting Platform asks for when you submit.
Start with the awareness time
The 24-hour clock starts when the manufacturer becomes aware. Record:
- awareness date and time, and who became aware;
- how the information arrived;
- what the team knew at that moment;
- why the team treated the issue as an Article 14 case;
- who approved the current timeline.
This is a workflow record, not a legal conclusion. Confirm the awareness point with counsel or a compliance adviser when it is in doubt.
Choose the case track
Article 14 separates an actively exploited vulnerability contained in a product with digital elements from a severe incident having an impact on the security of the product. The early warning should say which track you are using. If you are not yet certain, record the uncertainty and the evidence still being checked, rather than leaving it in a chat thread. The track matters because later deadlines differ:
- the 72-hour notification is counted from awareness for both tracks;
- the final report for an actively exploited vulnerability is due no later than 14 days after a corrective or mitigating measure is available;
- the final report for a severe incident is due within one month after the incident notification.
CRA Article 14 reporting deadlines explained · CRA Article 14 final report: deadlines and contents
Confirm the reporting route
Early warnings go through ENISA's Single Reporting Platform to the CSIRT designated as coordinator. Under Article 14(7) that is the CSIRT of your main establishment in the EU, where decisions on the cybersecurity of your products are mainly taken. With no main establishment in the EU, the order is the Member State of the authorised representative, then the importer, then the distributor (in each case the one handling the highest number of your products), then the Member State where most of your users are. This should already be settled before the 24-hour clock starts. Which CSIRT do you notify under CRA Article 14?
Protect the 72-hour deadline
The early warning is only the first step. As soon as it is sent, put the 72-hour notification in view and assign owners for:
- affected product and version facts;
- current exploit or incident assessment;
- mitigations, workarounds or fixes already available;
- user communication;
- evidence capture;
- official submission through the reporting route;
- final-report tracking.
CRA 72-hour notification: what to include
Questions people ask
- What is the CRA 24-hour early warning?
- The first report in the CRA Article 14 reporting chain. The manufacturer sends an early warning notification of an actively exploited vulnerability contained in a product with digital elements, or of a severe incident having an impact on the security of the product.
- When is the 24-hour early warning due?
- Without undue delay and in any event within 24 hours of the manufacturer becoming aware of the actively exploited vulnerability or severe incident.
- What does Article 14 ask for in the early warning?
- For an actively exploited vulnerability, Article 14(2)(a) asks the early warning to indicate, where applicable, the Member States where the manufacturer is aware the product has been made available. For a severe incident, Article 14(4)(a) asks it to include at least whether the incident is suspected of being caused by unlawful or malicious acts, and also to indicate, where applicable, those Member States.
- Is the 24-hour early warning the full report?
- No. The 72-hour notification follows, counted from awareness. Then the final report: for an actively exploited vulnerability, no later than 14 days after a corrective or mitigating measure is available; for a severe incident, within one month after the incident notification.
- Does VexRoute file the official early warning?
- No. Early warnings are submitted through ENISA's Single Reporting Platform. VexRoute's free desk helps you log the awareness time, classify the case, track the deadlines and keep your case file in one place.