EU Cyber Resilience Act, CRA Product Security and CE Marking Reporting Obligations

Article 14 creates mandatory reporting for actively exploited vulnerabilities and for severe incidents having an impact on the security of the product with digital elements. The reporting packages and final report timelines differ slightly, so the triage step needs to classify the event correctly.

The Commission FAQ is also useful on what is not mandatory. A zero day found in good faith without evidence of malicious exploitation is not, by itself, a mandatory Article 14 notification.

For both tracks, the first clock is the same. The manufacturer must send an early warning without undue delay and in any event within twenty four hours of becoming aware. The next notification is due within seventy two hours of awareness unless the relevant information has already been provided.

The final deadline then depends on the event type.

Notifications go through the single reporting platform established by ENISA. They are submitted using the electronic notification end point of the CSIRT designated as coordinator in the Member State of the manufacturer's Union main establishment and are simultaneously accessible to ENISA.

If there is no Union main establishment, Article 14 uses a fallback order based on authorised representative, importer, distributor, and then user location.

Article 14(8) requires the manufacturer to inform impacted users, and where appropriate all users, of the vulnerability or incident and any mitigating or corrective measures they can take. The information should be structured and machine readable where appropriate and easy to process automatically.

If the manufacturer fails to inform users in a timely manner, the notified CSIRTs may do so when necessary and proportionate.

The Commission FAQ notes that if an actively exploited vulnerability sits in a third party component, both the component manufacturer and the final product manufacturer may need to notify where each has placed an affected product on the market.

This means component visibility and product genealogy are essential for Article 14 readiness.