What Article 14 covers
Two kinds of reportable event:
- actively exploited vulnerabilities contained in a product with digital elements;
- severe incidents having an impact on the security of the product.
The duty also covers products already on the market before the CRA's main application date (Article 69(3)). An older product you still support can start the Article 14 clock today.
Deadline 1: the 24-hour early warning
Due within 24 hours of becoming aware. This is where teams get stuck: something is wrong, but there is no root cause, fix or approved wording yet. The early warning is meant to go out before those exist. Capture what you know at the moment of awareness and assign owners for the next deadline. What to send in the 24-hour early warning.
Deadline 2: the 72-hour notification
Due within 72 hours of becoming aware. By now you need a clear case file: affected product and versions, when you became aware, your current assessment, mitigations, likely users affected, and who is submitting. What to include in the 72-hour notification.
Deadline 3a: final report for an exploited vulnerability
Due within 14 days after a corrective or mitigating measure is available. The date of the fix matters, not the date you became aware, so record both. What belongs in the final report.
Deadline 3b: final report for a severe incident
Due within one month after the 72-hour notification. At least a detailed description of the incident with its severity and impact, the likely threat type or root cause, and applied and ongoing mitigation measures. What belongs in the final report.
Which CSIRT do you report to?
The CSIRT acting as coordinator in the Member State of your main establishment, meaning where decisions about the cybersecurity of your products are mainly taken (Article 14(7)). With no main establishment in the EU, the order is the Member State of the authorised representative, then the importer, then the distributor (in each case the one handling the highest number of your products), then the Member State where most of your users are.
Settle this before anything happens. Hour 21 of a 24-hour deadline is the wrong time to work out your reporting route. How to work out which CSIRT is yours.
What to prepare before an incident
- A list of your in-scope products with digital elements.
- A named owner for Article 14 reporting.
- Who can submit through ENISA's Single Reporting Platform.
- A vulnerability disclosure contact and triage process.
- A way to record when you first became aware of a case.
- Evidence for why a case is, or is not, reportable.
- Draft wording for telling affected users (required by Article 14(8)).
Questions people ask
- When did CRA Article 14 reporting start?
- The reporting obligations in Article 14 of the EU Cyber Resilience Act apply from 11 September 2026.
- What is due within 24 hours?
- An early warning, within 24 hours of the manufacturer becoming aware of an actively exploited vulnerability or a severe incident affecting the security of its product.
- What is due within 72 hours?
- A fuller notification, within 72 hours of becoming aware, with the information available about the vulnerability or incident and any corrective or mitigating measures.
- When is the final report due?
- For an actively exploited vulnerability, within 14 days after a corrective or mitigating measure is available. For a severe incident, within one month after the 72-hour notification.
- Does this apply to products already on the market?
- Yes. Under Article 69(3), the Article 14 reporting obligations also apply to products with digital elements placed on the market before the CRA's main application date.