CRA Article 14 Compliance: 24h / 72h / Final Report
Article 14 of Regulation (EU) 2024/2847 introduces a three-stage reporting cascade for actively exploited vulnerabilities and significant incidents. From 11 September 2026, every EU manufacturer of a product with digital elements has to be ready to file the 24-hour early warning. This page covers the trigger criteria, the three deadlines, and how to operate the workflow.
The three-stage reporting cascade
All three stages submit to ENISA and the relevant national CSIRT via the Single Reporting Platform. The clock starts when the manufacturer becomes aware of the triggering event.
- 24 hours
Early warning
Notify ENISA and the relevant national CSIRT via the Single Reporting Platform that an actively exploited vulnerability or a significant incident has been identified. The early warning is brief: indication of the issue, suspected unlawful or malicious nature, and any cross-border impact.
- 72 hours
Detailed report
Submit a detailed report covering the technical nature of the vulnerability or incident, severity, impact, indicators of compromise where available, and any corrective or mitigating measures taken or planned.
- +14 days (exploited vulnerabilities) / +1 month (significant incidents)
Final report
Submit a final report describing the vulnerability or incident, its severity, root cause, corrective measures applied, and (for significant incidents) any cross-border impact. The clock starts from the original notification.
Two trigger conditions
Article 14 applies to two distinct categories. The reporting process is the same; the qualifying event differs.
Actively exploited vulnerability
A vulnerability in a product with digital elements that the manufacturer has reasonable evidence is being exploited in the wild. Evidence can come from incident response, threat intelligence, third-party reports, or internal telemetry.
Significant incident
A security incident that has a significant impact on the security of the product or on its users. The CRA references criteria including the number of users affected, the duration of the incident, and the geographical spread.
What goes in each report
24h early warning
Identification of the manufacturer and the affected product, indication of the issue (vulnerability or incident), the suspected unlawful or malicious nature where relevant, and any known cross-border impact. The early warning is deliberately short.
72h detailed report
Technical description of the vulnerability or incident, severity, impact assessment, indicators of compromise where available, the corrective or mitigating measures taken or planned, and an updated cross-border impact assessment.
Final report
Detailed description of the vulnerability or incident, including root cause, severity, applied corrective measures, the timeline of events, and (for significant incidents) any cross-border impact. Submitted within 14 days of the original notification for actively exploited vulnerabilities, or within one month for significant incidents.
Frequently asked
When does CRA Article 14 apply?
Who has to report under Article 14?
What is the Single Reporting Platform?
What happens if I miss the 24-hour deadline?
Do I have to report low-severity vulnerabilities?
How does CVD Portal help with Article 14?
Make Article 14 boring before September 2026
CVD Portal tracks the 24h, 72h, and final-report deadlines automatically from the moment a triage event is flagged as Article 14-relevant. Free and Pro provide guided manual workflows. Enterprise automates submission to the ENISA Single Reporting Platform.