Where the report goes

Once, via the single reporting platform established under Article 16 (set up and operated by ENISA), to the electronic notification end-point of the CSIRT designated as coordinator of the member state of the manufacturer's main establishment in the Union — simultaneously accessible to ENISA. Main establishment = where cybersecurity decisions are predominantly taken, falling back to the most EU employees. With no main establishment in the Union, Article 14(7) supplies a FOUR-step order, on the information available to the manufacturer: (a) member state of the authorised representative acting for the most products, (b) of the importer placing the most products on the market, (c) of the distributor making the most products available, (d) the member state in which the highest number of users of the manufacturer's products are located. A manufacturer reporting under point (d) may send notifications of any subsequent actively exploited vulnerability or severe incident to the same coordinator CSIRT it first reported to.

Fine relief for micro and small

Administrative fines are disapplied to manufacturers that qualify as microenterprises or small enterprises with regard to any failure to meet the deadline referred to in Article 14(2)(a) or Article 14(4)(a) — the two 24-hour early warnings, and nothing else

What counts as micro or small

Microenterprise — fewer than 10 staff and annual turnover and/or annual balance sheet total not exceeding €2 million. Small enterprise — fewer than 50 staff and annual turnover and/or annual balance sheet total not exceeding €10 million. Partner and linked enterprises (broadly, a 25%-or-more holding) are pulled into the calculation under Article 3 of the Annex.

€15,000,000 or 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher

Anything owed retroactively

No. Because the duty attaches to becoming aware of active exploitation, a manufacturer is not required to report vulnerabilities of whose active exploitation it had already become aware before 11 September 2026; the CRA does not require retroactive reporting. The converse does bind: where the manufacturer knew of a vulnerability before that date but was not aware of any active exploitation, and exploitation occurs or comes to its attention after 11 September 2026, the vulnerability is deemed actively exploited and the reporting duty applies.

A third-party component

No. The duty covers actively exploited vulnerabilities contained in the manufacturer's own product. Where a third-party component carries a vulnerability that either cannot be exploited in the product (the guidance gives unreachable vulnerable code as the example) or has not been exploited in it, that vulnerability is not subject to mandatory reporting by that manufacturer. Voluntary notification under Art. 15 remains available, and the Annex I Part II vulnerability-handling duties and the Art. 13(6) upstream report to the component maintainer still apply.

Is this legal advice?

No. PartsProof is a documentation and readiness service. We build your process artifacts from the regulation’s published text and ENISA guidance. For legal questions about your specific exposure, talk to counsel — our scope memo gives them a running start.

Does this make my product CE-compliant?

No, and be wary of anyone who says a document pack can. Full conformity (Annex I, CE marking) lands December 11, 2027 and involves real security engineering. This pack covers the September 11, 2026 reporting obligations completely, and the included gap checklist shows exactly what 2027 will ask of you.

I already sell in the EU. Does the deadline still apply to me?

Yes. Article 14 applies from September 11, 2026 to every in-scope product, including ones placed on the market before then, and the duty outlives the support period. It is not retroactive reporting, though: Commission guidance of July 27, 2026 confirms you owe nothing for exploitation you had already become aware of before that date. The clock runs on what you learn from September 11 onward.

What exactly do I have to report?

Two things: actively exploited vulnerabilities in your product, and severe incidents affecting its security. Each triggers the cascade — early warning in 24 hours, notification in 72, final report in 14 days (vulnerabilities) or a month (incidents) — filed once through the CRA Single Reporting Platform, addressed to the CSIRT where you have your main establishment. The runbook walks each step with the forms pre-drafted.

What’s an SBOM and why do I need one?

A software bill of materials — a machine-readable list of every component and dependency in your product. It’s how you answer “are we affected?” in minutes instead of days when a dependency CVE drops, and it’s expected under the CRA’s vulnerability-handling requirements.

My product is mostly open source. Am I exempt?

Only if it’s outside commercial activity. The moment you charge for the product, support, or hosting, you’re a manufacturer under the CRA. Open-source stewards get a lighter regime — the scope checker walks that edge case.

The CRA reporting clock, stage by stage

An actively exploited vulnerability and a severe incident start the same three-stage clock, and only the last stage runs to different end dates. All of it goes to one place.

From 11 September 2026, Article 14 gives a manufacturer an early warning within 24 hours of becoming aware, a full notification within 72 hours, and a final report whose deadline depends on which trigger it was. Everything goes to the ENISA single reporting platform, routed to the coordinator CSIRT of your main establishment.

Stage	Deadline	Actively exploited vulnerability	Severe incident
Early warning	Within 24 hours of the manufacturer becoming aware	an actively exploited vulnerability (Art. 14(2)(a))	a severe incident (Art. 14(4)(a))
Full notification	Within 72 hours of becoming aware	vulnerability notification (Art. 14(2)(b))	incident notification (Art. 14(4)(b))
Final report	See each column — the two triggers run to different end dates	no later than 14 days after a corrective or mitigating measure is available (Art. 14(2)(c))	within one month after submission of the 72-hour incident notification (Art. 14(4)(c))

Whether the clock is running at all

Seven questions decide it, and what it costs when it is.

When Article 14 starts to apply: 11 September 2026
Where the report goes: Once, via the single reporting platform established under Article 16 (set up and operated by ENISA), to the electronic notification end-point of the CSIRT designated as coordinator of the member state of the manufacturer's main establishment in the Union — simultaneously accessible to ENISA. Main establishment = where cybersecurity decisions are predominantly taken, falling back to the most EU employees. With no main establishment in the Union, Article 14(7) supplies a FOUR-step order, on the information available to the manufacturer: (a) member state of the authorised representative acting for the most products, (b) of the importer placing the most products on the market, (c) of the distributor making the most products available, (d) the member state in which the highest number of users of the manufacturer's products are located. A manufacturer reporting under point (d) may send notifications of any subsequent actively exploited vulnerability or severe incident to the same coordinator CSIRT it first reported to.
Fine relief for micro and small: Administrative fines are disapplied to manufacturers that qualify as microenterprises or small enterprises with regard to any failure to meet the deadline referred to in Article 14(2)(a) or Article 14(4)(a) — the two 24-hour early warnings, and nothing else
What counts as micro or small: Microenterprise — fewer than 10 staff and annual turnover and/or annual balance sheet total not exceeding €2 million. Small enterprise — fewer than 50 staff and annual turnover and/or annual balance sheet total not exceeding €10 million. Partner and linked enterprises (broadly, a 25%-or-more holding) are pulled into the calculation under Article 3 of the Annex.
The penalty ceiling: €15,000,000 or 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher
Anything owed retroactively: No. Because the duty attaches to becoming aware of active exploitation, a manufacturer is not required to report vulnerabilities of whose active exploitation it had already become aware before 11 September 2026; the CRA does not require retroactive reporting. The converse does bind: where the manufacturer knew of a vulnerability before that date but was not aware of any active exploitation, and exploitation occurs or comes to its attention after 11 September 2026, the vulnerability is deemed actively exploited and the reporting duty applies.
A third-party component: No. The duty covers actively exploited vulnerabilities contained in the manufacturer's own product. Where a third-party component carries a vulnerability that either cannot be exploited in the product (the guidance gives unreachable vulnerable code as the example) or has not been exploited in it, that vulnerability is not subject to mandatory reporting by that manufacturer. Voluntary notification under Art. 15 remains available, and the Annex I Part II vulnerability-handling duties and the Art. 13(6) upstream report to the component maintainer still apply.

Every figure above is the value carried in this site’s claim register, re-verified against its primary source on 2026-07-29. Source: Regulation (EU) 2024/2847, Article 14(2)(a) and 14(4)(a).