This article is a practical engineering overview, not legal advice. Check the details of your obligations with your legal advisor.
Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents under Article 14 of the Cyber Resilience Act. This also applies to products already on the market. The clock starts when you become aware of the issue – and 24 hours is short if nobody knows who does what.
What has to be reported – and when
| Deadline | Actively exploited vulnerability | Severe incident |
|---|---|---|
| 24 hours | Early warning | Early warning |
| 72 hours | Vulnerability notification: product, nature of the exploit, measures taken or available to users | Incident notification: nature of the incident, initial assessment, measures |
| Final report | No later than 14 days after a corrective or mitigating measure is available | Within one month after the incident notification |
Reports go through ENISA's single reporting platform to the CSIRT designated as coordinator in your Member State. You must also inform affected users about the vulnerability or incident and the mitigations they can apply.
The playbook in eight steps
- Name an owner and a deputy. One person decides whether something is reportable. Holidays and weekends included.
- Open the front door. A security contact on your website, a
security.txtfile and a published coordinated vulnerability disclosure (CVD) policy. Researchers and customers must know where to report. - Know what is inside your product. A maintained SBOM for each product and firmware version – including third-party modules such as radio stacks.
- Monitor. Track vulnerability sources for the components in your SBOM, and log incoming reports with a timestamp.
- Triage with clear criteria. Is the vulnerability actively exploited? Which products, versions and markets are affected? Document the decision, including "not reportable".
- Use templates. Prepare the content of the early warning, the 72-hour notification and the final report in advance, so nobody writes them from scratch under pressure.
- Fix and inform. A secure, authenticated update path is a precondition. Without it, the only mitigation you can offer is a workaround.
- Rehearse. Run a tabletop exercise once a year: a fictitious report arrives on a Friday afternoon. Does the process hold?
The engineering side is the bottleneck
The paperwork can be set up in weeks. What usually takes months is in the product: a missing SBOM for old firmware versions, no way to update a radio module in the field, or update packages that are not signed. These are the points to plan first.
CRA Readiness Check
Gap analysis, Art. 14 and CVD set-up, product classification and a prioritised action plan.
CRA series: Part 1 – What manufacturers must do and when · Part 2 – Article 14 reporting · Part 3 – EN 18031 checklist