EU Cyber Resilience Act · Article 14
Reporting starts 11 September 2026
From that date, an actively exploited vulnerability in something you placed on the EU market has to reach ENISA and your national CSIRT within 24 hours. Here is the honest minimum.
What the clock actually looks like
Three obligations, all counted from the moment you become aware. The awareness timestamp is the part teams get wrong.
- 24 hours
Early warning
ENISA + national CSIRT
From the moment you become aware that a vulnerability in a product you placed on the market is being actively exploited. It can be short: what you know, and that you are investigating.
In alloy-it: Awareness is stamped when you record the exploit, and the 24h payload is drafted from your product and release data.
- 72 hours
Vulnerability notification
ENISA + national CSIRT
The fuller picture: affected products and versions, severity and impact, and any corrective or mitigating measures available to users.
In alloy-it: Affected releases come from your inventory and triage decisions, so scoping is not a manual archaeology exercise.
- 14 days
Final report
ENISA + national CSIRT
After a corrective measure is available: the vulnerability's nature, the fix, and what you did about it.
In alloy-it: The evidence pack pulls the SBOM, findings, triage history, and awareness timeline for the affected release.
What you need in place before the date
Five things. None of them require a finished SBOM programme, and most of them are information you already have.
- 1
A list of products you placed on the market
An afternoonName, support period, and risk class for each. This is the unit the CRA holds you accountable for.
- 2
The releases that went out
An afternoonVersion by version. When an authority asks what is affected, this is the list you scope against.
- 3
Your reporter identity
30 minutesCompany details, manufacturer ID, designated national CSIRT, and a named contact. Filling this in during an incident is how filings go wrong.
- 4
A route to hear about exploitation
Already have oneA customer, a partner, a CERT bulletin, or your own telemetry. Recording it manually is enough to start the clock correctly.
- 5
Someone who owns the 24-hour clock
One decisionNamed, with a deputy. The obligation is time-bound and does not pause for holidays.
What is not required yet
Most teams stall on obligations that do not apply until December 2027. Clearing those away is usually what unblocks September.
A complete SBOM programme
Article 14 reporting does not require an SBOM. It helps you find out faster, but you can report without one.
CE marking or a notified body
Conformity assessment and CE marking apply from 11 December 2027, not now.
Emailing your customers
September 2026 is a report to authorities. Informing users sits with vulnerability handling, toward full application in December 2027.
A finished PSIRT function
A named owner and a way to record awareness is the minimum. The rest can mature after the date.
What it looks like when the clock is running
Awareness stamped, deadlines tracked per incident, affected releases already scoped from your inventory.
| Exploit ID | CVE | Product | First aware | 24h early warning | 72h notification | 14d final | Status |
|---|---|---|---|---|---|---|---|
| EXP-2026-004 | CVE-2026-1337 | GW-4200 Gateway | 68h ago | sent | in 4h | in 12d | Reporting |
| EXP-2026-003 | CVE-2026-0912 | TX-90 Sensor | 3d ago | sent | sent | in 9d | Patch in progress |
| EXP-2026-002 | CVE-2025-8841 | GW-4200 Gateway | 22d ago | sent | sent | filed | Closed |
- Awareness timestamp per incident
- 24h / 72h / 14d payloads drafted
- Affected releases scoped from triage
The minimum is still reachable
Add your products and releases, fill in your reporter identity, and you can file correctly on day one. Start free, or walk through it with us.
This page provides general information about the EU Cyber Resilience Act and is not legal advice. The regulation and its harmonised standards are still evolving: consult the official EU, ENISA, and BSI sources and qualified counsel for your specific product. alloy-it helps with product inventory, SBOM monitoring, triage, Article 14 evidence, and the rebuild path; it is not CE-marking software, not a notified body, and does not submit reports to ENISA or national CSIRTs.