Guide · Regulation (EU) 2024/2847

CRA Article 14, in plain English.

What the EU Cyber Resilience Act requires when a vulnerability in your connected product is being exploited: who reports, by when, what to say, and where.

Start reading Calculate your deadlines

Last reviewed 12 October 2026· 12 sections· Every rule links to its source

The short version

Since 11 September 2026, if you make a connected product sold in the EU and learn that a vulnerability in it is being actively exploited, you must report it through ENISA’s Single Reporting Platform:

24h
Early warning
after becoming aware
72h
Notification
after becoming aware
14 days
Final report
after a fix or mitigation

…and you must inform affected users. Art. 14(1), (2), (8) (source, opens in a new tab) Art. 71(2) (source, opens in a new tab)

Who it applies to

Article 14 applies to manufacturers of products with digital elements made available on the EU market: hardware and software with a data connection, such as smart plugs, cameras, sensors, gateways, industrial controllers, and the firmware and apps that run them. It applies wherever the manufacturer is based. A maker in Sheffield or Shenzhen selling into the EU has the same reporting duty as one in Munich.CRA Art. 2, 3, 14 (source, opens in a new tab)

There is no small-company exemption from reporting itself. Micro and small firms get partial relief from fines, explained under Penalties.

What triggers a report

The trigger

The trigger is an actively exploited vulnerability in your product: reliable evidence that someone has exploited it. A newly published CVE that nobody is exploiting doesn’t trigger Article 14 on its own, although you still have to handle it. Art. 14(1) (source, opens in a new tab)

When the clock starts

The clock starts when you become aware, not when you finish investigating and not when you submit anything. In practice that’s often the moment an exploited-vulnerability list, a researcher or a customer tells you something that touches a component you ship. Art. 14(2) (source, opens in a new tab)

A second, separate trigger is a severe incident affecting the security of your product.

The deadlines

Article 14 deadlines for actively exploited vulnerabilities
Report	Deadline	Source
Early warning	24 hours after becoming aware, and without undue delay	14(2)(a) (source, opens in a new tab)
Vulnerability notification	72 hours after becoming aware, unless already provided	14(2)(b) (source, opens in a new tab)
Final report	14 days after a corrective or mitigating measure is available	14(2)(c) (source, opens in a new tab)

Work out your own deadlines with the free CRA deadline calculator.It handles time zones and clock changes, and exports to your calendar.

What goes in each report

early warning24h
Early warning
Short by design. It must state, where applicable, the EU member states where you know the product has been made available, so you need to know where each product is sold before an incident.
14(2)(a) (source, opens in a new tab)
vulnerability notification72h
Vulnerability notification
Unless already provided, general information, as available, about:
- the product concerned,
- the general nature of the exploit and of the vulnerability,
- any corrective or mitigating measures taken, and measures users can take,
- where applicable, how sensitive you consider the information to be.
14(2)(b) (source, opens in a new tab)
final report14d
Final report
14 days after a fix or mitigation is available:
- a description of the vulnerability, including its severity and impact,
- where available, information about any malicious actor that exploited it,
- details of the security update or other corrective measures made available.
Art. 14(2)(c) (source, opens in a new tab)

Where you report

Through ENISA’s Single Reporting Platform. A notification goes at the same time to the CSIRT designated as coordinator and to ENISA. 14(1), 14(7) (source, opens in a new tab)

The coordinating CSIRT is usually the one in the member state where you have your main establishment in the EU. If you have none in the EU, the regulation sets fall-backs in order: your authorised representative, then your importer, then your distributor, then the member state with the most users.14(7) (source, opens in a new tab) ENISA FAQ (source, opens in a new tab)

Main EU establishment
Authorised representative
Importer
Distributor
Most users

Informing your users

After becoming aware, you must inform impacted users, and where appropriate all users, about the actively exploited vulnerability or severe incident. Where needed, include risk mitigation and corrective measures they can deploy, where appropriate in a structured, machine-readable format. If you don’t inform users in time, the CSIRT may do it. 14(8) (source, opens in a new tab)

In practice: a plain-language advisory for customers and, ideally, a machine-readable one such as a CSAF advisory.

Severe incidents

Article 14 also covers severe incidents affecting the security of your product. An incident is severe if it harms, or could harm, the product’s ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions. It is also severe if it has led, or could lead, to malicious code being introduced or run in the product or in users’ systems.14(3), 14(5) (source, opens in a new tab)

The timeline differs slightly for incidents: 14(4) (source, opens in a new tab)

24 hours
Early warning
including whether you suspect unlawful or malicious acts
72 hours
Incident notification
with an initial assessment and mitigations
1 month
Final report
after the incident notification

Penalties

Maximum fine

€15,000,000

or 2.5% of worldwide turnover

Breaching the obligations in Article 14 can lead to administrative fines of up to €15,000,000 or 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher. Art. 64(2) (source, opens in a new tab)

Small-company relief

Micro and small enterprises can’t be fined for missing only the 24-hour early-warning deadline. The relief covers only that deadline; missing the 72-hour notification or the final report is not exempt. Art. 64(10)(a) (source, opens in a new tab)

Key dates

11 Sep 2026
Article 14 reporting obligations
Art. 71(2) (source, opens in a new tab)
11 Dec 2027
The rest of the regulation, including essential cybersecurity requirements
Art. 71(2) (source, opens in a new tab)

ENISA’s platform in practice

EU Login with MFA. People who submit for a manufacturer need a personal EU Login account with multi-factor authentication. Create these before you need them. FAQ Q9 (source, opens in a new tab)
Assigned Representatives. The platform calls these users “Assigned Representatives”. A manufacturer can have primary and secondary ones, and they can submit and update notifications. This is a platform role, not the same thing as an authorised representative under the CRA. FAQ Q9 (source, opens in a new tab)
Web forms only. There is no API at the platform’s initial release; notifications are entered through the web interface. FAQ Q15 (source, opens in a new tab)
Don’t trust the 72-hour counter. The platform shows the 72-hour notification as due 48 hours after you submit the early warning, not 72 hours after awareness. ENISA says the counters are for visibility only and will change in a future release. Run your own clock from awareness. FAQ Q26 (source, opens in a new tab)

How to prepare

Keep an SBOM for every firmware version you ship.
Name someone, and a backup, to watch known-exploited vulnerability lists every day.
Register at least two people on the Single Reporting Platform via EU Login.
Keep a list of the EU countries where each product is sold.
Publish a vulnerability disclosure policy and a security contact.
Make sure you can ship security updates to devices in the field.
Prepare templates for the three reports and the customer advisory.
Agree who is on call at weekends and holidays.

See how you score with the CRA 24-hour readiness check.It takes two minutes and stores nothing.

Sources

Warnbell is an independent company and isn’t affiliated with ENISA or the European Union. This guide is general information, not legal advice. If something here is wrong or out of date, tell us at info@warnbell.com.