Most of the EU Cyber Resilience Act (CRA) applies from 11 December 2027. One part did not wait: the reporting duty in Article 14 has applied since 11 September 2026, and it also covers products that are already on the market.

If you make hardware or software with a data connection and sell it in the EU, this is the first CRA deadline that can actually catch you. Here is the short version, plus a free template at the end.

What you have to report

Two kinds of event, both through ENISA's Single Reporting Platform (SRP):

  • An actively exploited vulnerability: reliable evidence that someone has exploited a vulnerability in your product without the owner's permission. A bug you found and fixed before anyone exploited it is normal vulnerability handling, not an Article 14 report.
  • A severe incident: an incident that negatively affects, or could affect, the product's ability to protect the availability, authenticity, integrity or confidentiality of data or functions. The severity criteria are in Article 14(5), so read them.

A third-party guide notes that exploitation you already knew about before 11 September 2026 does not have to be notified. Confirm that against the Regulation text for your case.

The clock

The clock starts when you become aware, not when your investigation is finished.

Stage Actively exploited vulnerability Severe incident
Early warning 24 hours 24 hours
Notification 72 hours 72 hours
Final report 14 days after a fix or mitigation is available One month after the 72-hour notification

The early warning is meant to be short. It carries what you know at hour 24. You do not wait for a root-cause analysis.

Who you report to

One submission through the SRP reaches both ENISA and a coordinating CSIRT that you select:

  • EU-based manufacturer: the Member State of your main EU establishment, where cybersecurity decisions for the product are mainly made.
  • Manufacturer outside the EU: the first option that applies, in this order: where your authorised representative acts for the most products, then your importer, then your distributor, then where most users are located.

ENISA's FAQ warns that selecting the wrong CSIRT can lead to the report being invalidated and having to be resubmitted.

Set up before you need it

The platform launched in English only and has no API, so reports are entered through the web form. Registration takes some steps, and you do not want to discover them at hour 20:

  1. Everyone who may file creates their own EU Login account, with multi-factor authentication on.
  2. On the portal, choose "Assigned Representative" and log in.
  3. One Primary representative per manufacturer registers and selects the CSIRT.
  4. Wait for "Verified" status before inviting Secondary representatives (up to 20).
  5. Name a backup filer. One person on holiday should not be a single point of failure.

One practical detail from ENISA's FAQ: the platform's 72-hour counter runs from the early-warning submission, so it can show a different due time from your legal deadline. Keep your own clock, and record four timestamps for every candidate event: first signal, triage started, evidence met the definition, early warning submitted.

A free template

I put the decision guide, the four-question check, the set-up checklist and an editable early-warning template into a free kit: https://github.com/mohnadjib/cra-article-14-reporting-kit

Prefer to have the files sent to your inbox? The same kit is also a free download on Payhip: https://payhip.com/b/xhMeB

It is a practical aid, not legal advice. Field names and limits on the real form are in ENISA's SRP Glossary, so check them before you file.

Sources