Five Months to September: What CRA Article 14 Compliance Actually Requires

11 September 2026 is when Article 14 reporting obligations become enforceable - for products already on the market. Full CRA conformity isn't until December 2027. The September deadline is the operational one.

What Must Be Operational by September 2026

• Article 13 VDP - publicly accessible vulnerability disclosure channel
• Triage process - ability to determine active exploitation within hours
• 24-hour early warning to ENISA and national CSIRT
• 72-hour detailed technical notification
• 14–30 day final report with disclosure strategy
• Full audit trail of all vulnerability handling activity

The SME Gap

Most SMEs selling hardware or software into the EU market have none of this infrastructure. Building it in-house - VDP, structured intake, triage workflow, authority reporting, audit trail - requires months of engineering. For organisations starting from zero today, five months is tight.

The clock does not wait for infrastructure to be built.