Cyber Resilience Act Article 14 Reporting Obligations

Article 14 has two mandatory reporting tracks. The first is an actively exploited vulnerability contained in the product with digital elements. The second is a severe incident having an impact on the security of the product with digital elements. Treat them as separate triage outcomes because the final-report timing and content are not identical.

For an actively exploited vulnerability, the legal trigger is reliable evidence that a malicious actor exploited a vulnerability without permission of the system owner. A zero-day is not automatically reportable just because no patch exists; the Commission FAQ says mandatory reporting depends on reliable evidence of malicious exploitation. Vulnerabilities found in good-faith testing, bug bounty, laboratory assessment, correction, or disclosure are not mandatory Article 14 notifications unless that exploitation evidence exists.

Both mandatory tracks begin with awareness by the manufacturer. Article 14 requires an early warning without undue delay and in any event within 24 hours. The next notification is due without undue delay and in any event within 72 hours unless the relevant information has already been provided.

The final report clock is different for each track. For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure is available. For a severe incident, the final report is due within one month after the incident notification. If more status detail is needed, the CSIRT designated as coordinator initially receiving the notification may request intermediate reports.

Article 14 notifications are submitted via the single reporting platform established by ENISA. The report uses the electronic notification endpoint of the CSIRT designated as coordinator for the relevant Member State and is simultaneously accessible to ENISA.

For a manufacturer with a Union main establishment, the relevant Member State is where decisions related to the cybersecurity of its products are predominantly taken. If that cannot be determined, Article 14 uses the Union establishment with the highest number of employees.

After becoming aware of an actively exploited vulnerability or severe incident, the manufacturer must inform impacted users and, where appropriate, all users. The notice must cover the vulnerability or incident and, where necessary, risk-mitigation and corrective measures users can deploy.

The CRA also says this user information should be provided, where appropriate, in a structured, machine-readable format that is easily automatically processable. If the manufacturer does not inform users in a timely manner, the notified CSIRTs may provide that information to users when proportionate and necessary to prevent or mitigate impact.

The CRA vulnerability handling obligations apply to the product with digital elements in its entirety, including integrated components. The Commission FAQ says that if an actively exploited vulnerability originates in an integrated component, the finished-product manufacturer must notify it when the vulnerability is contained in and actively exploitable in its product. The component manufacturer may also have its own obligation if it placed the component on the market.

If a component vulnerability exists but cannot be exploited in the finished product, it is not an actively exploited vulnerability for that product on that basis. Article 13(6) can still require the manufacturer to report the vulnerability upstream to the person or entity manufacturing or maintaining the component, and Article 15 voluntary reporting can still be considered.

A useful Article 14 record is not just the submitted form. It should show how the manufacturer identified awareness, classified the trigger, selected the CSIRT route, met each reporting stage, informed users, and followed through on corrective or mitigating measures.

For legacy products placed on the market before 11 December 2027, the Commission FAQ recognises that old tooling, build environments, dependencies, or staff knowledge may be missing. That does not remove Article 14 reporting once the reporting obligation applies and the manufacturer becomes aware, so the file should also record investigation limits and the evidence available at each stage.