CRA Article 14: how to report vulnerabilities and incidents

01Who is covered, and since when?

Article 14 started to apply on 11 September 2026, ahead of the rest of the Regulation. The obligation covers every product with digital elements on the EU market, including products placed on the market before that date (Article 69(3)).

The obligation sits with the manufacturer. A manufacturer outside the EU must report too if the product is placed on the EU market. For points specific to manufacturers outside the EU, see the CRA readiness guide.

Two situations trigger a report:

• Actively exploited vulnerability: a vulnerability in the product for which there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission (Article 3(42), Article 14(1)).
• Severe incident: an incident that affects the security of the product and negatively affects, or is capable of affecting, its ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions; or that has led to malicious code being introduced or executed in the product or in the user's systems (Articles 14(3) and 14(5)).

A vulnerability that has not been exploited does not require a mandatory Article 14 report; it can be reported voluntarily under Article 15. Fixing it is mandatory in any case under Annex I Part II.

02To whom and how?

Reports are submitted through ENISA's Single Reporting Platform (SRP). The platform forwards each report simultaneously to the CSIRT designated as coordinator and to ENISA (Article 14(1), Article 16).

The coordinating CSIRT is the one of the Member State where the manufacturer has its main establishment. For manufacturers without a main establishment in the EU, it is, in this order, the Member State of the authorised representative, the importer or the distributor; failing those, the Member State with the most users of the product (Article 14(7)).

ENISA states that the first release of the SRP has no API for automated submission. Reports are entered in the portal, so having the content ready in advance matters for meeting the deadlines.

03Deadlines and report content

Deadlines run from the moment the manufacturer becomes aware of the active exploitation or the incident. The Regulation asks for each step without undue delay; the times below are maximums.

Actively exploited vulnerability (Article 14(2))

Severe incident (Article 14(4))

04Informing users

After becoming aware, the manufacturer informs the impacted users, and where appropriate all users, about the vulnerability or incident and the measures they can take, where appropriate in a structured, machine-readable format (Article 14(8)).

If users are not informed in a timely manner, the notified CSIRT may provide that information itself.

05Checklist for meeting the deadlines

1. Know which products contain which components. A current SBOM lets you see within minutes which products and firmware versions a newly published CVE affects.
2. Watch exploitation signals. Sources such as CISA's Known Exploited Vulnerabilities catalogue (KEV) and EPSS show early which vulnerabilities are being exploited. The decision is always your team's.
3. Define the moment of becoming aware. Write down who decides, how that moment is recorded and when the 24 hour clock starts.
4. Template the report content in advance. Product information, the Member States where it is sold and contact details repeat in every report.
5. Set up your ENISA SRP access and owners. Plan for weekends and holidays.
6. Prepare the channel for informing users. A security advisory page, an e-mail list or CSAF advisories.
7. Keep records. Store what was learned and sent, and when, in a form that cannot be altered; market surveillance authorities may ask.

Breaching Article 14 can lead to administrative fines of up to €15 million or 2.5% of worldwide annual turnover, whichever is higher (Article 64(2)). See the CRA guide.

06Frequently asked questions