CRA Article 14: how 24-hour reporting of exploited vulnerabilities works
Published 2026-11-11
Since 11 September 2026, manufacturers selling connected hardware and software on the EU market must report actively exploited vulnerabilities and severe security incidents within fixed deadlines under Article 14 of the Cyber Resilience Act. The clock starts when you become aware, and weekends count.
The three deadlines
- Within 24 hours: early warning. State that you are aware, which Member States the product is available in, and whether you suspect malicious action.
- Within 72 hours: notification. Add product information, the nature of the vulnerability and of the exploit, corrective measures taken or recommended to users, and how sensitive the information is.
- Final report: for an exploited vulnerability, within 14 days after a corrective measure is available; for a severe incident, within one month after the notification. It covers description, severity, impact, information on the malicious actor and security update details.
What triggers a report
Two situations: you become aware of an actively exploited vulnerability in your product, or a severe incident affecting its security. A vulnerability that merely exists does not trigger the 24-hour clock; evidence of exploitation does, for example a listing in CISA KEV or in ENISA's EUVD.
Who receives the report
Reports go through ENISA's single reporting platform and reach both the designated CSIRT and ENISA. Which Member State's CSIRT is competent follows the rules in Article 14, usually linked to your main establishment in the Union or your authorised representative. A person you designate signs in with a personal EU Login and submits on the web; there is no API at present, so a third party cannot submit for you.
Informing users
Besides reporting to the authorities, manufacturers must promptly inform affected users about the risk and the mitigations they can apply.
Penalties
Breaches of Article 14 fall in the higher fine tier of Article 64: up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher.
Practical hurdles for hardware makers outside the EU
- Defining the moment of awareness: keep a record of who first saw the advisory, and when.
- Nights and holidays: 24 hours includes weekends and public holidays, so you need an owner and a backup.
- English regulatory wording: the platform is in English and engineering teams are rarely used to it.
- Mapping advisories to products: the component in an advisory must be matched to your firmware and chipsets.
What Watchpost does: it keeps matching exploited-vulnerability sources against your products, starts the countdown on a hit, alerts the owner and a backup, and drafts the English report text for each stage for your authorised person to review and copy into the ENISA platform. Watchpost does not submit for you, and you remain responsible for the content.
FAQ
When does the CRA 24-hour clock start?
When the manufacturer becomes aware that a vulnerability is being actively exploited, or of a severe incident. Weekends and holidays count.
Who receives CRA reports?
They go through ENISA's single reporting platform to the designated CSIRT and to ENISA at the same time.
Can a third party submit the report for us?
Not at present. Submission is made on the web by a person you designate using a personal EU Login; there is no API.
More guides
- CRA authorised representative: do Chinese manufacturers need one?
- CRA reporting readiness: a checklist for hardware makers
This article summarises the public text of the EU Cyber Resilience Act (Regulation (EU) 2024/2847) for general information. It is not legal advice; rely on the regulation itself and your own counsel.