Overview
The Cyber Resilience Act’s Article 14 reporting duty applies from 11 September 2026, before the Regulation generally applies from 11 December 2027. This series shows manufacturers how to classify actively exploited vulnerabilities and severe incidents in products with digital elements, preserve the awareness point, run distinct vulnerability and incident reporting stages, route one submission through the Single Reporting Platform, and connect notification to user action, remediation, support, and supervision. It explains why early reporting must be fast without overstating incomplete facts, while product scope, legal roles, market availability, dissemination exceptions, and later implementation details require documented, current judgment.
Learning outcomes
- Article 14 reporting applies from 11 September 2026, before the CRA generally applies on 11 December 2027.
- Reliable evidence of unauthorized exploitation and severe product-security impact are distinct triggers, although one event can satisfy both.
- The vulnerability final report is due no later than 14 days after a measure becomes available; the severe-incident final report is due within one month after notification.
- The reporting chain is designed to connect authority notification with user action, updates, support, and later supervision.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
When does Article 14 of the Cyber Resilience Act apply?
Article 14 reporting obligations apply from 11 September 2026, while the CRA generally applies from 11 December 2027. The earlier duty also reaches in-scope products placed on the market before the later date.
What makes a product-security event reportable under the Cyber Resilience Act?
Article 14 covers an actively exploited vulnerability or a severe incident affecting, or capable of affecting, the security of an in-scope product with digital elements. Active exploitation requires reliable evidence of unauthorized use; severity depends on protected important data or functions or a malicious-code path.
How do the Cyber Resilience Act reporting deadlines differ?
The vulnerability track requires an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days after a corrective or mitigating measure is available. The severe-incident final report is due within one month after the incident notification.
How does one Cyber Resilience Act report reach several Member States?
A manufacturer submits through the Single Reporting Platform to the coordinator CSIRT endpoint selected by its Union establishment or the prescribed fallback. ENISA has simultaneous access, and the initial CSIRT disseminates the notice to relevant Member States based on known product availability.
Does a Cyber Resilience Act report replace remediation?
No. The manufacturer must still inform impacted users and, where appropriate, all users; make corrective or mitigating measures available; disseminate security updates without delay; and handle vulnerabilities during the support period.