When does the CRA reporting clock start?

Article 14 sets every deadline by reference to the moment the manufacturer becomes aware, but the regulation does not define that moment.^[1] Commission guidance C(2026) 5252 fills the gap. Where a manufacturer detects a suspicious event, or a third party such as a researcher, customer, authority or media organisation brings something to its attention, the manufacturer should assess it immediately. Awareness arises when, after that initial assessment, there is a reasonable degree of certainty that a vulnerability contained in the product is being actively exploited, or that a severe incident has occurred and has compromised the security of the product.^[4]

The practical consequence is that a short, documented triage window sits before the clock starts. That window is not open-ended. The guidance stresses prompt action to carry out the initial assessment, particularly where the vulnerability may pose a significant risk.

The Commission did not invent a new standard. It aligned the CRA reading with recital 31 of Implementing Regulation (EU) 2024/2690 under NIS2, and with Section II(A) of the EDPB guidelines on personal data breach notification under the GDPR.^[4][5] The stated purpose is to let manufacturers subject to comparable obligations under different EU acts apply the concept consistently.

That matters operationally. One event can trigger CRA, NIS2 and GDPR notification duties at once. A single documented awareness determination, recorded with its timestamp and the reasoning behind it, can anchor all three timelines instead of three separate judgements that later turn out to disagree.

Once awareness is established, the cadence is fixed. An early warning notification goes to the coordinating CSIRT and ENISA without undue delay and in any event within 24 hours.^[1] A fuller notification follows within 72 hours. The complete report is due within 14 days after a corrective or mitigating measure becomes available for an actively exploited vulnerability, or within one month after the 72-hour notification for a severe incident.^[4]

Manufacturers are expected to update notifications progressively as the investigation advances. The 24-hour filing is an early warning containing limited information, so a thin first submission is the design rather than a failure.

First, there is no retroactive reporting. Active exploitation a manufacturer had already become aware of before 11 September 2026 does not have to be reported. Where a vulnerability was known before that date but its exploitation was not, and exploitation occurs or comes to light afterwards, the obligation applies.^[4]

Second, a vulnerability in an integrated third-party component is only reportable where it is actively exploited in your product. Where the vulnerable code is unreachable, or exploitation has not occurred in your product, no mandatory report arises, although voluntary notification under Article 15 stays open and upstream reporting under Article 13(6) is still required.^[4][2]

Third, the reporting obligations outlive the support period. Vulnerability handling under Annex I Part II stops when support ends, and Article 14 reporting does not.^[4]