CRA Article 14 applies on 11 September 2026

Article 14 obliges every manufacturer of products with digital elements to notify ENISA and the relevant CSIRT of any actively exploited vulnerability or severe incident affecting the security of the product. The cascade is an early warning within 24 hours, an intermediate notification within 72 hours, and a final report within 14 days for an actively exploited vulnerability or one month for a severe incident.

Article 14 is the only substantive obligation that moves this early. Under Article 71(2) the Regulation applies from 11 December 2027, and the sole derogations are Article 14 from 11 September 2026 and Chapter IV on notified bodies from 11 June 2026. So Article 14 comes 15 months ahead of the rest.

Everything else arrives on 11 December 2027, including placing on the market, CE marking, conformity assessment, and the Article 13 manufacturer obligations such as the coordinated vulnerability disclosure policy and the security contact. In practice the CVD process needs to be running before September 2026 anyway, because Article 14 reporting depends on it.