Active Exploitation and Incident Reporting — 24h, 72h, and 14-Day Obligations

Article 14 establishes a three-stage notification process triggered by active exploitation of a vulnerability or a severe security incident:

All three deadlines are calculated from the moment the manufacturer becomes aware of the active exploitation or incident — not from when exploitation began.

Two conditions trigger Article 14 notification:

1. Active exploitation — A vulnerability in your product is being actively exploited in the wild. This means there is evidence of real-world attacks using the vulnerability, not just proof-of-concept code.

1. Severe security incident — A security incident that has (or may have) a significant impact on the security of users of your product, or a significant impact on the internal operations of your organisation.

Not triggered by: Theoretical vulnerabilities, vulnerabilities with no known exploitation, low-severity bugs, or normal vulnerability reports received through your CVD programme that are not actively exploited.

Notifications must be submitted to the competent national authority (typically your national CSIRT or market surveillance authority), which will relay reports to ENISA. Each EU member state will designate a point of contact.

ENISA is establishing a Single Reporting Platform for Article 14 notifications. Until this is operational, manufacturers should contact their national CSIRT directly.

• Germany: BSI (Federal Office for Information Security)
• France: ANSSI
• Netherlands: NCSC-NL
• Sweden: NCSC-SE
• Spain: CCN-CERT / INCIBE-CERT

CVD Portal can draft Article 14 notifications in the required format and alert you when deadlines are approaching.

The 24-hour early warning is not a full technical report — it is a rapid notification that exploitation is occurring. ENISA uses this signal to coordinate cross-border incident response before the full picture is known.

• Product name and affected version(s)
• Nature of the vulnerability or incident (brief description)
• Indication that active exploitation is occurring
• Geographic scope if known
• Initial mitigation actions taken (if any)

You do not need to have a root cause analysis or patch ready at this stage. Speed of notification is the priority.

Within 72 hours of becoming aware of active exploitation, you must submit a full vulnerability notification. This expands on the early warning with:

• CVSS 3.1 (or 4.0) score and vector string
• CVE identifier (or a request for one if not yet assigned)
• Affected products, versions, and configurations
• Description of the impact on confidentiality, integrity, and availability
• Known attack vectors and exploitation techniques
• Mitigations available (patches, workarounds, configuration changes)
• Supply chain impact assessment (are other products affected?)

72 hours is a very tight window for a complete analysis. This means your incident response process must be able to move very quickly when an active exploitation is confirmed.

The 14-day final report provides ENISA with a complete post-incident analysis. It must include:

• Root cause analysis
• Complete remediation details (patch release, advisory publication)
• CSAF advisory (if applicable)
• Supply chain coordination actions taken
• Steps taken to prevent recurrence
• Lessons learned

If the incident is still ongoing at 14 days, you should submit a progress report explaining what is known and what remains under investigation.

Article 14 has significant supply chain implications. If a vulnerability affects components you source from third-party vendors, you are still responsible for the Article 14 notification for your product — but you must also:

1. Notify the component vendor if the vulnerability originates in their component
2. Coordinate with them on remediation timelines
3. Report the supply chain dimension in your Article 14 notifications

Conversely, if you are a component supplier and your component is found to be vulnerable, you must notify downstream manufacturers who integrate your component. This creates a notification cascade up and down the supply chain.