Disclosure Deadline Tracker
Enter a vulnerability report date and instantly see every critical deadline: Article 14 early warning, full notification, final report to ENISA, researcher 90-day embargo, and your internal acknowledgment SLA. Colour-coded status keeps you on track.
Last updated 1 September 2026
Key takeaways
- Article 14 establishes a 24-hour early warning, a 72-hour full notification, and a 14-day final report to ENISA upon awareness of active exploitation.
- Vulnerabilities that are not actively exploited follow standard coordinated disclosure procedures without triggering statutory ENISA reporting timelines.
- Industry standard coordinated vulnerability disclosure relies on a 90-day confidentiality embargo while the vendor develops a security patch.
- Article 64(2) subjects non-compliance with Article 14 to fines up to EUR 15 million or 2.5% of global annual turnover.
Vulnerability report details
Article 14 deadlines run from when your organisation becomes aware, not when the report was submitted.
Article 14 (active exploitation only)
Submit early warning to ENISA via the Single Reporting Platform. Triggered only if vulnerability is actively exploited.
Full notification to ENISA with CVSS score, root cause analysis, and remediation timeline.
Final report to ENISA with confirmed root cause and completed remediation.
Internal SLAs
Confirm receipt of the vulnerability report. CRA Article 13 minimum.
Internal severity assessment and CVSS score assigned. Engineering engaged.
Researcher embargo
After 90 days from report, researcher may disclose publicly regardless of patch status. Contact researcher proactively if patch is not ready.
If an extension was agreed with the researcher, this is the standard extended window for complex vulnerabilities.
Note: All deadlines are calculated from the report date entered above. Business day SLAs are shown as calendar hours for simplicity. CVD Portal tracks these deadlines automatically and sends alerts before breach.
Frequently asked
What are the Article 14 notification deadlines?+
When a manufacturer becomes aware of an actively exploited vulnerability, Article 14 of the CRA sets three deadlines. An early warning goes to ENISA within 24 hours. A full notification follows within 72 hours. A final report is due within 14 days. These deadlines run from the moment the manufacturer becomes aware of active exploitation.
Does Article 14 apply to every vulnerability?+
No. Article 14 notification obligations are triggered only when the vulnerability is actively exploited in the wild. Vulnerabilities that are reported but not exploited follow standard CVD handling - acknowledgment, triage, remediation, and coordinated disclosure - without mandatory ENISA notification.
What is the researcher 90-day embargo?+
The 90-day embargo is the industry-standard window during which the vulnerability remains confidential while a fix is developed. After 90 days, the researcher may disclose publicly regardless of patch status. Some programmes use 120 or 180 days for complex issues.
What happens if I miss an Article 14 deadline?+
Missing an Article 14 deadline is a violation of the CRA and can result in enforcement action by national market surveillance authorities. Fines under the CRA can reach up to EUR 15 million or 2.5% of global annual turnover for the most serious violations.
Other free CRA tools
Ready to automate your CVD programme?
CVD Portal integrates all these tools and handles your Article 13 and 14 obligations automatically.
Start your free portal →