As of September 11, 2026, Article 14 of the EU Cyber Resilience Act (CRA, Reg. (EU) 2024/2847) officially enters into force. It brings not just a new regulatory platform or an additional vulnerability reporting form, but a full set of vulnerability and incident response obligations with clear time requirements.
In other words, the old pace of "handling vulnerabilities slowly after discovery" that enterprises used to follow is being pushed toward a new phase of "rapid assessment upon discovery, timely reporting, and full traceability throughout the process".
I. What Exactly Does CRA Article 14 Regulate?
Article 14 of the CRA centers on the obligation to report actively exploited vulnerabilities and serious security incidents.
✅ Applicable entities: Manufacturers of products with digital features placed on the EU market. Enterprises in sectors including consumer electronics, industrial control equipment, communication equipment, software and firmware, chips and semiconductors all fall within the scope of regulation.
✅ Reporting channel: The EU Single Reporting Platform (SRP), which is synchronously connected to Computer Security Incident Response Teams (CSIRTs) of all member states and the European Union Agency for Cybersecurity (ENISA).
⚠️ High penalties require full attention: Non-compliant enterprises face a maximum penalty of 2.5% of their global annual turnover or 15 million euros, whichever is higher.
For enterprises expanding into the EU market, this is by no means a compliance clause that can be remedied after an incident occurs. Inadequate preparation will lead to huge economic losses.
II. The Rules Are in Effect: Full Operational Closed Loop for Platform and Legislation
Article 14 of the CRA has long moved beyond paper-based regulations, with all supporting measures fully in place:
Transparent reporting platform procedures: On August 3, 2026, ENISA updated the CRA Single Reporting Platform and released the SOP for Registration of Appointed Representatives (AR) and the SOP for Notification Submission, fully disclosing the entire registration and reporting process with supporting screenshots of the operation interface. The operational procedures for enterprises to appoint representatives and submit incident notifications online are now clear and implementable.
Legislative details complete the final link: On December 11, 2025, the European Commission issued an implementing act clarifying the conditions under which CSIRTs may delay notification to other member states on legitimate cybersecurity grounds. With this, the notification mechanism under Article 14 has completed its legislative closed loop.
III. Two Types of Trigger Scenarios: Reporting Is Not Only Required When "Under Attack"
Many enterprises hold a misconception: reporting is only required when products are hacked and cause actual losses. This is not the case — two types of scenarios will trigger reporting obligations.
Scenario 1: Actively exploited security vulnerabilities
When a vulnerability is actually exploited by attackers:
A warning must be issued within 24 hours from the time the manufacturer becomes aware of the incident
A full incident report must be submitted within 72 hours
After vulnerability remediation and risk mitigation measures are implemented, a final report must be submitted to complete the full incident closed loop
Scenario 2: Serious security incidents
Even if a vulnerability has not been exploited by hackers, high-risk security hazards in products may also trigger reporting requirements. Enterprises need to submit a structured risk report and continuously update the progress of incident handling.
