Cyber Resilience Act Article 14 Reporting Obligations

Article 14 has two mandatory reporting tracks. The first is an actively exploited vulnerability contained in the product with digital elements. The second is a severe incident having an impact on the security of the product with digital elements. Treat them as separate triage outcomes because the tests, final-report timing, and final-report content are not identical.

For an actively exploited vulnerability, the legal trigger is reliable evidence that a malicious actor exploited a vulnerability without permission of the system owner. A zero-day is not automatically reportable just because no patch exists; the Commission FAQ says mandatory reporting depends on reliable evidence of malicious exploitation. Vulnerabilities found in good-faith testing, bug bounty, laboratory assessment, correction, or disclosure are not mandatory Article 14 notifications unless that exploitation evidence exists.

Both mandatory tracks begin with awareness by the manufacturer. Article 14 requires an early warning without undue delay and in any event within 24 hours. The next notification is due without undue delay and in any event within 72 hours unless the relevant information has already been provided.

The final report clock is different for each track. For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure is available. For a severe incident, the final report is due within one month after the incident notification. If more status detail is needed, the CSIRT designated as coordinator initially receiving the notification may request intermediate reports.

From 11 September 2026, each Article 14 notification is to be submitted once through the Single Reporting Platform established by ENISA instead of separately to multiple authorities. The Commission says the platform will be operational by that date, with testing beforehand. The submission uses the electronic notification endpoint of the CSIRT designated as coordinator for the relevant Member State and is simultaneously accessible to ENISA, subject to the CRA's exceptional dissemination-delay rules.

For a manufacturer with a Union main establishment, the relevant Member State is where decisions related to the cybersecurity of its products are predominantly taken. If that cannot be determined, Article 14 uses the Union establishment with the highest number of employees.

ENISA's 17 July 2026 platform FAQ says the dedicated public URL will be published before launch. Manufacturer and open-source steward representatives will register through EU Login; the selected CSIRT can validate authority to submit alongside the first report without blocking submission. ENISA also says no application programming interface will be provided at this stage, so planned automation still needs a web-submission fallback.

After becoming aware of an actively exploited vulnerability or severe incident, the manufacturer must inform impacted users and, where appropriate, all users. The notice must cover the vulnerability or incident and, where necessary, risk-mitigation and corrective measures users can deploy.

Where appropriate, the manufacturer must provide this user information in a structured, machine-readable format that is easily automatically processable. If the manufacturer does not inform users in a timely manner, the notified CSIRTs may provide the information when proportionate and necessary to prevent or mitigate impact.

The CRA vulnerability handling obligations apply to the product with digital elements in its entirety, including integrated components. The Commission FAQ says that if an actively exploited vulnerability originates in an integrated component, the finished-product manufacturer must notify it when the vulnerability is contained in and actively exploitable in its product. The component manufacturer may also have its own obligation if it placed the component on the market.

If a component vulnerability exists but cannot be exploited in the finished product, it is not an actively exploited vulnerability for that product on that basis. Article 13(6) can still require the manufacturer to report the vulnerability upstream to the person or entity manufacturing or maintaining the component, and Article 15 voluntary reporting can still be considered.

The Article 14 record should include the submitted form and show how the manufacturer identified awareness, classified the trigger, selected the CSIRT route, met each reporting stage, informed users, and followed through on corrective or mitigating measures.

For legacy products placed on the market before 11 December 2027, the Commission FAQ recognises that old tooling, build environments, dependencies, or staff knowledge may be missing. Those limits do not remove Article 14 reporting once it applies and the manufacturer becomes aware. Record the investigation limits and evidence available at each stage. The broader CRA cybersecurity and vulnerability-handling duties do not apply to that older product merely because Article 14 applies; Article 69(2) separately addresses products that are substantially modified from 11 December 2027.