Article 14 reporting obligations apply from 11 September 2026. They concern actively exploited vulnerabilities and severe incidents having an impact on the security of products with digital elements.
Trigger and timing
The manufacturer must assess the legal trigger and act promptly. The Commission explains the early warning at 24 hours and fuller notification at 72 hours after awareness. Final-report timing differs between actively exploited vulnerabilities and severe incidents.
Official channel
ENISA’s CRA Single Reporting Platform is the submission route described by the Commission. This site neither accepts reports nor forwards notifications. Verify operational details directly with the official platform.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.