Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847) is the part that applies first. It tells manufacturers what to report, to whom, and how fast: an early warning within 24 hours, a notification within 72 hours, and a final report later. This article sets out the deadlines exactly as the regulation counts them.
What has to be reported
Two things, both through ENISA's Single Reporting Platform, which delivers each report at the same time to the CSIRT designated as coordinator and to ENISA:
- An actively exploited vulnerability contained in your product (Art. 14(1)). "Actively exploited" means there is reliable evidence that a malicious actor has exploited it in a system without the permission of the system owner (Art. 3(42)). A vulnerability found in good-faith testing is not a mandatory report (recital 68).
- A severe incident having an impact on the security of your product (Art. 14(3)). An incident is severe if it affects, or may affect, the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or if it leads, or may lead, to malicious code being introduced or executed in the product or in users' systems (Art. 14(5)).
When the clock starts
Every deadline runs from the moment the manufacturer becomes aware of the exploited vulnerability or the severe incident. The regulation does not define "aware", so record the moment you knew, and why.
Actively exploited vulnerability: 24 h, 72 h, 14 days
| Step | Deadline | Content |
|---|---|---|
| Early warning | within 24 hours of becoming aware (Art. 14(2)(a)) | where known, the Member States where the product is made available |
| Vulnerability notification | within 72 hours of becoming aware (Art. 14(2)(b)) | general information about the product, the general nature of the exploit and the vulnerability, corrective measures taken and measures users can take, how sensitive the information is |
| Final report | no later than 14 days after a corrective or mitigating measure is available (Art. 14(2)(c)) | description, severity and impact of the vulnerability; information on the malicious actor, if available; details of the security update or other corrective measure |
Severe incident: 24 h, 72 h, one month
| Step | Deadline | Content |
|---|---|---|
| Early warning | within 24 hours of becoming aware (Art. 14(4)(a)) | at least whether the incident is suspected of being caused by unlawful or malicious acts, and the Member States concerned |
| Incident notification | within 72 hours of becoming aware (Art. 14(4)(b)) | the nature of the incident, an initial assessment, corrective measures taken and measures users can take, how sensitive the information is |
| Final report | within one month after the incident notification was submitted (Art. 14(4)(c)) | detailed description, severity and impact; the type of threat or root cause likely to have triggered it; applied and ongoing mitigation measures |
Note the difference: for an incident, the final report counts from when you submitted the 72-hour notification, not from when a fix is available.
Rules that apply to both
- The deadlines are limits, not targets. Each step is due "without undue delay and in any event within" the period.
- The later steps are needed unless the relevant information has already been provided.
- The CSIRT may ask for an intermediate report (Art. 14(6)).
- Which CSIRT: the one of the Member State where you have your main establishment in the EU (Art. 14(7)). Without an EU establishment, the order is your authorised representative, then the importer, then the distributor, then the Member State with the most users.
- Your users: you inform the affected users, and where appropriate all users, about the vulnerability or incident and the measures they can take, where appropriate in a structured, machine-readable format (Art. 14(8)).
Since when, and for which products
Art. 14 applies from 11 September 2026 (Art. 71(2)). It covers products placed on the market before 11 December 2027 as well (Art. 69(3)). According to ENISA's FAQ, exploitation you became aware of before 11 September 2026 does not need a retroactive report; if you become aware later, you report it even if the vulnerability itself is older.
Small companies
Small companies are not exempt. Art. 64(10)(a), as corrected on 2 July 2025, only means that micro and small enterprises cannot be fined for missing the 24-hour early warning deadline. The 72-hour notification and the final report still apply, and so do the rules for medium-sized companies. Breaches of Art. 14 can otherwise be fined up to €15 million or 2.5% of worldwide annual turnover, whichever is higher (Art. 64(2)).
Submitting on ENISA's platform
Reports are entered at portal.cra-srp.enisa.europa.eu with a personal EU Login account protected by multi-factor authentication. They are submitted by the manufacturer's assigned representative, and the platform is in English. ENISA's FAQ says no API is provided at the initial release, so reports are entered through the platform interface.
One detail to watch: ENISA's platform currently counts its 72-hour timer from the early warning, so it can show a later time than the regulation. The regulation counts from the moment you became aware.
How Vulnio helps
Vulnio is built for small software and connected-device makers:
- Free: a CRA scope check, and a one-off scan of an SBOM or lock file that lists the vulnerabilities CISA KEV or ENISA EUVD mark as actively exploited first. A listing alone does not mean your product is affected: you check whether the vulnerable code is shipped and reachable in your product.
- Paid plans, from €29 a month (excluding VAT): a daily re-scan with an e-mail alert on new exploited matches, an incident log that counts the 24-hour, 72-hour and final report deadlines from the time you enter, and drafts of the early warning, notification and final report in the order of the platform's fields, plus a user notice draft in English and German.
Vulnio does not decide whether you must report, and it never submits anything to ENISA. You review the drafts and submit them yourself.
This article is information, not legal advice.
Sources: EUR-Lex, Regulation (EU) 2024/2847 (Cyber Resilience Act); ENISA, Single Reporting Platform pages and FAQ.
