CRA Article 14 reporting is already applicable as of 11 September 2026. It is separate from the main product-conformity requirements due on 11 December 2027. Manufacturers of products within the CRA’s scope need a process that works when an event is discovered, not only when a patch is ready.
Identify the reporting trigger
Report an actively exploited vulnerability contained in the product, or a severe incident affecting its security, under the definitions and conditions in Article 14. A new CVE, a scanner finding or a high CVSS score alone does not establish active exploitation. They still require triage and vulnerability handling.
Severe incidents have their own legal criteria; do not reduce them to any outage or any suspected attack. Record the available evidence, affected versions, impact and the time the organisation became aware. Do not wait for every technical detail to be confirmed before meeting the early-warning deadline.
The three-stage reporting timeline
| Event | Early warning | Detailed notification | Final report |
|---|---|---|---|
| Actively exploited vulnerability | Within 24 hours of awareness | Within 72 hours of awareness | No later than 14 days after a corrective or mitigating measure becomes available |
| Severe security incident | Within 24 hours of awareness | Within 72 hours of awareness | Within one month of the detailed notification |
Both early deadlines start from awareness: the 72 hours do not start after the first 24-hour report. A mitigating measure can trigger the vulnerability final-report deadline; it is not limited to a firmware patch. Record submission receipts and follow the required contents for each stage. The Commission’s reporting guidance explains the platform and recipients.
Submit through the Single Reporting Platform
Use the CRA Single Reporting Platform (SRP). The notification goes to the coordinating CSIRT determined under the regulation and, subject to exceptional dissemination provisions, to ENISA. Choose the correct main establishment or applicable fallback criteria; a convenient office location does not necessarily determine the recipient.
Prepare access, authorised submitters, an alternate contact and an internal escalation route. Follow the current ENISA platform guidance rather than relying on a hard-coded national-email list. Store evidence securely and mark sensitive technical information appropriately.
Existing products and users
Article 69 makes Article 14 applicable also to products placed on the market before the main application date. Do not limit the inventory to new models or products still actively advertised. Map installed versions and the relevant scope and transition conditions.
Inform affected users as required by Article 14, including the vulnerability or incident and available corrective or mitigating actions. Coordinate disclosure and security updates with suppliers, CSIRTs and customers without confusing regulatory reporting with public disclosure of exploit details.
Build a repeatable response
- Maintain a product/version inventory and dependency information to identify affected releases.
- Assign a response owner and backup with authority to escalate and submit.
- Keep an incident record with awareness time, evidence and decision rationale.
- Prepare 24-hour and 72-hour templates and rehearse out-of-hours handling.
- Track mitigation availability, final-report deadlines and customer notifications.
- Test the fix, preserve release evidence and check for related affected products.
Penalties and overlapping obligations
Article 64 sets an upper tier of €15 million or 2.5% of worldwide annual turnover, whichever is higher, for infringements including Article 14. These are legal maxima, not automatic fines for every event. Microenterprises and small enterprises have the specific Article 64(10)(a) exemption from fines for missing the early-warning deadline; this does not remove the reporting duty or all other penalties.
NIS2 concerns covered entities and their incidents, while CRA concerns products and manufacturers. One event may need both processes if both scopes apply. A CRA submission is not automatically a substitute for NIS2 or personal-data-breach notification.
CRA hardware checklist · EU compliance support · Discuss reporting readiness
Frequently asked questions
When did CRA Article 14 reporting start?
It has applied since 11 September 2026. The main product-conformity requirements have a different application date, 11 December 2027.
Do the 72 hours run after the early warning?
No. Both the 24-hour early warning and the 72-hour notification are measured from awareness of the relevant vulnerability or incident.
When is the final vulnerability report due?
No later than 14 days after a corrective or mitigating measure becomes available. For a severe incident, the final-report deadline is one month from the detailed notification.
Are old products excluded from reporting?
No. Article 69 extends Article 14 to products placed on the market before the main application date. Check the product scope and transition provisions, not only whether the model is still on sale.
Are small companies exempt from Article 14?
No. The specific exemption from fines for microenterprises and small enterprises missing the early-warning deadline does not abolish their reporting obligations.
Primary sources
Technical and regulatory references checked on 1 October 2026.
Related guides inEU Compliance & CE Marking
Explore all →EU Electronics Compliance: CE, CRA & RED
A product-specific CE roadmap for electronics: applicable legislation, evidence, assessment routes, RED cybersecurity and CRA responsibilities.
EU CRA Hardware Compliance Checklist
A risk-based CRA checklist for hardware: scope, product category, security requirements, SBOM, support period, reporting and conformity evidence.
EN 18031 Compliance: What "Self-Assessment" Actually Means for Connected Hardware
What EN 18031 self-assessment actually requires under Module A — and where the documented compliance gaps most often appear for connected hardware.
RED Delegated Act & EN 18031: Hardware Requirements
How the RED Delegated Act and EN 18031 define mandatory cybersecurity for radio equipment from August 2025 — with gaps that cannot be fixed in firmware.
EU Hardware Legislation 2026: Complete Guide
Which EU rules apply to your hardware? Distinguish CRA, RED, AI Act, ESPR and NIS2 scope, application dates and product-specific obligations.