Live since 11 September 2026. This is the first CRA obligation in force, and it covers products already on the EU market, not just new ones (Art. 71(2), Art. 69(3)).
Two events, and only these two. An actively exploited vulnerability in your product: someone is attacking through it, not merely that a bug exists. And a severe incident having an impact on the security of the product. Ordinary vulnerabilities you discover and patch quietly do not trigger Article 14; they fall under your general vulnerability-handling process in Annex I.
If neither event ever happens to your product, you never file anything. The duty is event-driven, like a fire alarm: everyone must have one, but you only call when there is a fire.
All from Art. 14(1)–(4). Reports go simultaneously to the coordinating CSIRT of your main establishment and to ENISA, through a single submission on the Single Reporting Platform operated by ENISA (Art. 16). Access is through an EU Login account; at launch the platform announced no API, so the workflow is a web form. Drafting the content in advance is what saves you inside a 24-hour window.
The clock starts when the manufacturer becomes aware. In a five-person company that is the moment a customer email lands, a researcher posts, or your own monitoring flags exploitation. There is no grace for "we were investigating". The defensible position is a written procedure: who receives reports, who decides, what the 24-hour message contains.
Breaching Article 14 sits in the top fine tier: up to €15,000,000 or 2.5% of worldwide annual turnover, whichever is higher (Art. 64(2)). One softening: Art. 64(10) exempts microenterprises and small enterprises from fines for missing the 24-hour early-warning deadline specifically. The duty itself still applies, and the 72-hour and final-report obligations remain fully fineable.
Article 14 is separate from the documentation regime (SBOM, technical file, CE marking) that applies from 11 December 2027. You can owe a report today for a product whose paperwork you have not started. That is the ordering most manufacturers find surprising.
Two free tools that apply this to your case: the 2-minute applicability check (does the CRA apply to you, with the clauses) and the SBOM generator (CycloneDX + SPDX from your manifest, signed). No signup for either.
Sources, primary only: Regulation (EU) 2024/2847 — EUR-Lex · European Commission — CRA summary · European Commission — CRA reporting · ENISA — Single Reporting Platform. Not legal advice; the regulation text controls.