Read the Arthur Cox briefing of 8 October 2026 next to the National CRA Guidelines of Ireland's NCSC, which add the Article 14 filing rules. Article 64 also sets two lower fine tiers that the briefing omits.
Key takeaways
- Arthur Cox LLP published a CRA briefing for Irish operators on 8 October 2026, four weeks after Article 14 reporting began on 11 September 2026.
- The NCSC National CRA Guidelines state that only a notification through the ENISA Single Reporting Platform satisfies Article 14, and that an email to the CSIRT is not a formal notification.
- The NCSC guidelines set the notification at 48 hours after the early warning, which can fall before the 72-hour limit in Article 14.
- Article 64 of the CRA sets three fine tiers and exempts micro and small enterprises from fines for a late early warning.
- Ireland has not yet confirmed its CRA market surveillance authority or its penalty rules.
What does the Arthur Cox briefing cover?
The Technology and Innovation group at Arthur Cox LLP published Countdown to compliance: The Cyber Resilience Act reporting deadline has arrived on 8 October 2026. The briefing names four key contacts. They are partners Colin Rooney, Olivia Mullooly and Ian Duffy, and senior associate Vivian Spies. It also thanks Cian Curley and Vivienne O'Keeffe for their contributions. The briefing brings the firm's 2022 note on the CRA proposal up to date for the regime now in force.
The briefing covers four topics. It sets out the duties of manufacturers, importers and distributors. It explains the conformity assessment routes and notes that no notified body has been appointed yet. It describes Article 14 reporting through the ENISA Single Reporting Platform, with a table of the three reporting stages. It ends with Irish implementation and a timeline to full application on 11 December 2027.
Two points in the briefing matter most for planning. Products placed on the market before 11 December 2027 are in scope for reporting while they are available. Ireland may also need national measures to designate a market surveillance authority and set penalties, and their form and timing are not yet confirmed.
What do the NCSC guidelines add for filing?
The National Cyber Security Centre published its National CRA Guidelines on 11 September 2026, the day Article 14 reporting began. The document is dated 31 August 2026 and covers Article 14 only. The government release announced it from the Department of Justice, Home Affairs and Migration, which the NCSC sits under.
The guidelines give six practical points that the briefing leaves out.
- Only a notification through the platform satisfies Article 14. An email to the CSIRT is not a formal notification.
- When ENISA issues a formal alert that the platform is unavailable, a manufacturer can send a voluntary email report to the CSIRT for urgent alerting. The formal notification still goes through the platform once it is back.
- Registration on the platform can wait until the first early warning. Account validation runs in parallel with the report.
- Exploitation that a manufacturer knew of before 11 September 2026 does not need a report.
- The coordinating CSIRT can delay dissemination to other CSIRTs in narrow cases under Commission Delegated Regulation (EU) 2026/881. An ongoing coordinated vulnerability disclosure is one of them.
- Process questions go to the CRA helpdesk at cra_helpdesk@ncsc.gov.ie. The NCSC does not advise on product scope, and a slow reply does not extend any deadline.
How do the Article 14 deadlines run?
| Stage | Actively exploited vulnerability | Severe incident | Source |
|---|---|---|---|
| Early warning | 24 hours from becoming aware | 24 hours from becoming aware | Article 14(2)(a) and 14(4)(a) |
| Notification | 72 hours from becoming aware | 72 hours from becoming aware | Article 14(2)(b) and 14(4)(b) |
| Final report | 14 days after a corrective or mitigating measure is available | One month after the notification | Article 14(2)(c) and 14(4)(c) |
The briefing's table matches the Regulation, with one small difference. It gives the final report for a vulnerability as 14 days after a corrective measure, and Article 14(2)(c) also counts a mitigating measure.
The NCSC guidelines add a second clock. They set the notification at 48 hours after the early warning is submitted. An early warning filed at hour 10 makes the notification due at hour 58 on the NCSC reading and at hour 72 under the Regulation. Plan to the earlier deadline until the NCSC or ENISA says otherwise.
Which points in the briefing need a second look?
Three points are worth checking before a reader relies on them. None of them changes the main message of the briefing.
Fines
The briefing gives the top tier only, up to €15 million or 2.5% of worldwide annual turnover. Article 64(2) applies that tier to the essential requirements in Annex I and to Articles 13 and 14. Article 64(3) sets up to €10 million or 2% for other obligations. Article 64(4) sets up to €5 million or 1% for incorrect, incomplete or misleading information. Article 64(10) exempts micro and small enterprises from fines for missing the 24-hour early warning deadline.
Critical products
The briefing says that critical products must use a European cybersecurity certification scheme. Article 32(4) also allows the Class II procedures where the conditions of Article 8(1) are not met.
The regulation number
The briefing calls the 2022 text the proposed Regulation (EU) 2024/2847. The 2022 proposal was COM(2022) 454, and the number 2024/2847 belongs to the act adopted on 23 October 2024.
What should a manufacturer do now?
- Decide where the main establishment is. Article 14(7) puts it where decisions on product cybersecurity are mainly taken, and that decides whether CSIRT-IE coordinates the notifications.
- Name who files on the platform and who approves each stage. Registration can wait until the first report, so the names are the real preparation.
- Write the outage fallback into the procedure, with the CSIRT email address and the rule that the platform filing still follows.
- Plan the notification to the earlier of the two clocks.
- List the products already on the market, because they are in scope for reporting.
- Watch for the Irish market surveillance designation and the penalty rules.
The Ireland country guide keeps the Irish contacts and the reporting route in one place. CVD Portal tracks the Article 14 deadlines and builds the package for the Single Reporting Platform on the Reporting tier.
Sources
- Arthur Cox LLP, Technology and Innovation group. Key contacts Colin Rooney, Olivia Mullooly, Ian Duffy and Vivian Spies, with contributions from Cian Curley and Vivienne O'Keeffe. Countdown to compliance: The Cyber Resilience Act reporting deadline has arrived. 8 October 2026.
- National Cyber Security Centre, Ireland. Guidelines on reporting obligations under Article 14 of the Cyber Resilience Act. Dated 31 August 2026, published 11 September 2026.
- Department of Justice, Home Affairs and Migration. Cyber Resilience Act guidelines published as reporting obligations come into effect. 11 September 2026.
- Regulation (EU) 2024/2847 (Cyber Resilience Act), CELEX 32024R2847, Articles 14, 32 and 64.
- Commission Delegated Regulation (EU) 2026/881 of 11 December 2025 supplementing Regulation (EU) 2024/2847 of the European Parliament and of the Council by specifying the terms and conditions for applying the cybersecurity-related grounds in relation to delaying the dissemination of notifications. Title as given in footnote 2 of the NCSC guidelines.
Frequently asked questions
Can a manufacturer send a CRA Article 14 report to the Irish NCSC by email?
No. The NCSC National CRA Guidelines state that only notifications submitted through the ENISA Single Reporting Platform satisfy Article 14. An email to the CSIRT counts only as a voluntary alert while ENISA reports the platform as unavailable.
When is the CRA Article 14 notification due in Ireland?
The notification is due within 72 hours of becoming aware of an actively exploited vulnerability or a severe incident. The NCSC guidelines also set it at 48 hours after the early warning, so a manufacturer should plan to the earlier deadline.
Which Irish authority enforces the Cyber Resilience Act?
Ireland has not yet confirmed its CRA market surveillance authority. The National Cyber Security Centre guides manufacturers on Article 14 reporting, and CSIRT-IE coordinates notifications from manufacturers whose main establishment is in Ireland.