Cyber Resilience Act Article 14 Reporting Obligations

Article 14 has two mandatory reporting tracks. The first is an actively exploited vulnerability contained in the product with digital elements. The second is a severe incident having an impact on the security of the product with digital elements. Treat them as separate triage outcomes because the tests, final-report timing, and final-report content are not identical.

For an actively exploited vulnerability, the legal trigger is reliable evidence that a malicious actor exploited a vulnerability without permission of the system owner. A zero-day is not automatically reportable just because no patch exists; the Commission FAQ says mandatory reporting depends on reliable evidence of malicious exploitation. Vulnerabilities found in good-faith testing, bug bounty, laboratory assessment, correction, or disclosure are not mandatory Article 14 notifications unless that exploitation evidence exists.

Both mandatory tracks begin with awareness by the manufacturer. Article 14 requires an early warning without undue delay and in any event within 24 hours. The next notification is due without undue delay and in any event within 72 hours unless the relevant information has already been provided.

The final report clock is different for each track. For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure is available. For a severe incident, the final report is due within one month after the incident notification. If more status detail is needed, the CSIRT designated as coordinator initially receiving the notification may request intermediate reports.

From 11 September 2026, each Article 14 notification is to be submitted once through the Single Reporting Platform established by ENISA instead of separately to multiple authorities. ENISA launched the platform on 11 September 2026. The submission uses the electronic notification endpoint of the CSIRT designated as coordinator for the relevant Member State and is simultaneously accessible to ENISA, subject to the CRA's exceptional dissemination-delay rules.

For a manufacturer with a Union main establishment, the relevant Member State is where decisions related to the cybersecurity of its products are predominantly taken. If that cannot be determined, Article 14 uses the Union establishment with the highest number of employees.

Use the live ENISA reporting portal linked below. Use ENISA's current registration instructions and Assigned Representative (AR) user manual to set up access and confirm the filing route before a deadline. Keep an authorised person able to submit a report through the platform.

After becoming aware of an actively exploited vulnerability or severe incident, the manufacturer must inform impacted users and, where appropriate, all users. The notice must cover the vulnerability or incident and, where necessary, risk-mitigation and corrective measures users can deploy.

Where appropriate, the manufacturer must provide this user information in a structured, machine-readable format that is easily automatically processable. If the manufacturer does not inform users in a timely manner, the notified CSIRTs may provide the information when proportionate and necessary to prevent or mitigate impact.

The CRA vulnerability-handling obligations cover the product in its entirety, including integrated components. The July 2026 Commission guidance says the finished-product manufacturer must report an actively exploited component-origin vulnerability contained in its product when aware of it. A separately marketed component manufacturer may have its own duty. The guidance distinguishes this from a component vulnerability that cannot be exploited in the finished product or has not been exploited in that product; those cases do not trigger mandatory Article 14 reporting by that manufacturer on that basis.

If a component vulnerability exists but cannot be exploited in the finished product, it is not an actively exploited vulnerability for that product on that basis. Article 13(6) can still require the manufacturer to report the vulnerability upstream to the person or entity manufacturing or maintaining the component, and Article 15 voluntary reporting can still be considered.

The Article 14 record should include the submitted form and show how the manufacturer identified awareness, classified the trigger, selected the CSIRT route, met each reporting stage, informed users, and followed through on corrective or mitigating measures.

For legacy products placed on the market before 11 December 2027, the Commission FAQ recognises that old tooling, build environments, dependencies, or staff knowledge may be missing. Those limits do not remove Article 14 reporting once it applies and the manufacturer becomes aware. Record the investigation limits and evidence available at each stage. The broader CRA cybersecurity and vulnerability-handling duties do not apply to that older product merely because Article 14 applies; Article 69(2) separately addresses products that are substantially modified from 11 December 2027.