Article 14 of the Cyber Resilience Act: what manufacturers report, and by when.
Since 11 September 2026, manufacturers have had to send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident in their products with digital elements. Here is the duty at a glance, and what it takes to meet it.
The deadlines
| Actively exploited vulnerability | Severe incident | |
|---|---|---|
| Early warning | within 24 hours of becoming aware | within 24 hours of becoming aware |
| Notification | vulnerability notification within 72 hours of becoming aware | incident notification within 72 hours of becoming aware |
| Final report | no later than 14 days after a corrective or mitigating measure is available | within one month after the incident notification |
Reports go through ENISA’s single reporting platform to the CSIRT designated as coordinator and to ENISA at the same time.
Four things that make the duty workable
Article 14 itself does not require a scanner, an SBOM or a proactive search; its deadlines run from the moment you become aware.
Know when you became aware.
The clock starts when you become aware, not when the vulnerability is published or fixed. If you cannot show when that was, you cannot show that you were on time.
Hear about exploitation within hours, not weeks.
Exploited vulnerabilities are listed in public catalogues such as CISA KEV and ENISA EUVD. Matching those lists against the components of every release you sell is the part that does not scale by hand.
Make sure a second person hears it.
A 24-hour deadline cannot depend on a single inbox. Name a backup, and let the alert reach them if nobody has acted.
Keep your own record.
The reporting platform is a web form in English that needs an EU Login with multi-factor sign-in. Record what you reported, when, and with which reference.
What the Reporting Desk does for each
BitHive Reporting Desk does each of these for you. Every hour, each monitored release is checked for actively exploited vulnerabilities listed by CISA KEV and ENISA EUVD, matched with OSV advisory data to its npm, PyPI, Maven, Go and NuGet components. It alerts your named contacts and your backup, runs the Article 14 clocks from the awareness time, prepares the report text field by field and records who knew what, when. You submit to ENISA yourself.
General information on Article 14 of Regulation (EU) 2024/2847, as of October 2026. Not legal advice.