EU Cyber Resilience Act: the 24h / 72h / 14-day reporting clock is live

Since 11 September 2026, Article 14 of the EU Cyber Resilience Act (Regulation (EU) 2024/2847) is in force for manufacturers. If you ship software or a connected device to EU customers, two events now start a reporting clock: an actively exploited vulnerability in your product, and a severe incident that affects its security. The rest of the regulation applies from 11 December 2027; reporting came first.

The three reports

	Actively exploited vulnerability	Severe incident
Early warning	within 24 hours of becoming aware	within 24 hours of becoming aware, incl. whether it looks malicious
Notification	within 72 hours: product, nature of the exploit, fixes and what users can do	within 72 hours: nature of the incident, initial assessment, mitigations
Final report	no later than 14 days after a fix or mitigation is available	within one month after the 72-hour notification

All three go through one channel: the CRA Single Reporting Platform run by ENISA. The notification is addressed to the CSIRT of the Member State where you have your main establishment and is made available to ENISA at the same time.

Put the clock in your runbook

Illustrative example. The deadlines are simple arithmetic from two timestamps: when you became aware, and when a fix shipped. Record both in UTC the moment they happen, so nobody has to reconstruct them later.

from datetime import datetime, timedelta, timezone

# when your team became aware of active exploitation
aware = datetime(2026, 10, 27, 14, 30, tzinfo=timezone.utc)
print("Early warning due:", aware + timedelta(hours=24))   # 2026-10-28 14:30 UTC
print("Notification due: ", aware + timedelta(hours=72))   # 2026-10-30 14:30 UTC

# final report: 14 days after a fix or mitigation is available
fix_available = datetime(2026, 11, 3, 9, 0, tzinfo=timezone.utc)
print("Final report due: ", fix_available + timedelta(days=14))  # 2026-11-17 09:00 UTC

Important. The reporting duty is not only for new releases. Article 69(3) applies Article 14 to products already placed on the market before 11 December 2027. And Article 14(8) adds a second audience: you also have to inform the impacted users about the vulnerability or incident and the mitigations they can apply, where appropriate in a structured, machine-readable format.

Checklist

• ☐ One owner who can file on the Single Reporting Platform, plus a backup
• ☐ Your CSIRT of main establishment identified
• ☐ "Aware at" and "fix available at" timestamps recorded in UTC
• ☐ List of EU Member States where the product is made available
• ☐ User advisory template ready (what happened, what to do)
• ☐ Incident record kept with type, time, reporter, actions and who was notified

The incident record is ready

An incident report with the fields you will need for all three CRA reports: type of incident (including security and IT outage), when and where, who reported it and when, what happened in order, immediate actions, severity and who was notified. Fill it in while the clock is running, not after.

Open the incident report →

Sources: Regulation (EU) 2024/2847 (Cyber Resilience Act), Art. 14, 69(3), 71(2), Official Journal L 2024/2847; European Commission, "Cyber Resilience Act – Reporting obligations"; ENISA, Single Reporting Platform.