EU Cyber Resilience Act · updated 2026-09-23

Article 14: the 24-hour reporting duty

Live since 11 September 2026. This is the first CRA obligation in force, and it covers products already on the EU market, not just new ones (Art. 71(2), Art. 69(3)).

What triggers a report

Two events, and only these two. An actively exploited vulnerability in your product: someone is attacking through it, not merely that a bug exists. And a severe incident having an impact on the security of the product. Ordinary vulnerabilities you discover and patch quietly do not trigger Article 14; they fall under your general vulnerability-handling process in Annex I.

If neither event ever happens to your product, you never file anything. The duty is event-driven, like a fire alarm: everyone must have one, but you only call when there is a fire.

The clock

All from Art. 14(1)–(4). Reports go simultaneously to the coordinating CSIRT of your main establishment and to ENISA, through a single submission on the Single Reporting Platform operated by ENISA (Art. 16). Access is through an EU Login account; at launch the platform announced no API, so the workflow is a web form. Drafting the content in advance is what saves you inside a 24-hour window.

What "aware" means for a small team

The clock starts when the manufacturer becomes aware. In a five-person company that is the moment a customer email lands, a researcher posts, or your own monitoring flags exploitation. There is no grace for "we were investigating". The defensible position is a written procedure: who receives reports, who decides, what the 24-hour message contains.

Fines, and the small-company softening

Breaching Article 14 sits in the top fine tier: up to €15,000,000 or 2.5% of worldwide annual turnover, whichever is higher (Art. 64(2)). One softening: Art. 64(10) exempts microenterprises and small enterprises from fines for missing the 24-hour early-warning deadline specifically. The duty itself still applies, and the 72-hour and final-report obligations remain fully fineable.

Relationship to the December 2027 obligations

Article 14 is separate from the documentation regime (SBOM, technical file, CE marking) that applies from 11 December 2027. You can owe a report today for a product whose paperwork you have not started. That is the ordering most manufacturers find surprising.

Sources, primary only: Regulation (EU) 2024/2847 — EUR-Lex · European Commission — CRA summary · European Commission — CRA reporting · ENISA — Single Reporting Platform. Not legal advice; the regulation text controls.

← All explainers