CRA Article 14 reporting — triggers, awareness and deadlines
Manufacturers' Article 14 obligations have applied since 11 September 2026. Reports concern actively exploited vulnerabilities and severe incidents impacting product security, not every scanner finding.
Capture awareness before working the case
Record when and how awareness was established, the timezone/UTC instant, recorder and evidence. Unknown facts require escalation, not a silent no-report decision. An interface detection date must not replace the legal awareness trigger.
24h → 72h → final report
Submit early warning without undue delay and within 24 hours, and notification within 72 hours of awareness. For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective measure is available. For a severe incident, it is due within one month of the 72-hour notification.
Manual SRP handoff and retained proof
Determine the competent coordinating CSIRT, responsible AR and stage. Retain submission timestamp, reference and evidence, then monitor validation and any invalidation/resubmission. Keep legal deadline calculations independent of SRP interface counters.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.