Chapter II - OBLIGATIONS OF ECONOMIC OPERATORS AND PROVISIONS IN RELATION TO FREE AND OPEN-SOURCE SOFTWARE
14

Article 14

Reporting obligations of manufacturers

Regulation (EU) 2024/2847 — published 10 December 2024 · Last reviewed by Kunnus: March 2026

Quick Answer for Manufacturers

Article 14 establishes the central reporting obligation: actively exploited vulnerabilities and severe incidents must be reported to ENISA and the relevant national CSIRT within 24h (early warning), 72h (full notification), and 14 days (final report).

This quick answer + FAQ supplements the original legal text with practice-oriented interpretation. Only the original text is legally binding.

(1)

A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that actively exploited vulnerability via the single reporting platform established pursuant to Article 16.

(2)

For the purposes of the notification referred to in paragraph 1, the manufacturer shall submit:

a)

an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it, indicating, where applicable, the Member States on the territory of which the manufacturer is aware that their product with digital elements has been made available;

b)

unless the relevant information has already been provided, a vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively exploited vulnerability, which shall provide general information, as available, about the product with digital elements concerned, the general nature of the exploit and of the vulnerability concerned as well as any corrective or mitigating measures taken, and corrective or mitigating measures that users can take, and which shall also indicate, where applicable, how sensitive the manufacturer considers the notified information to be;

c)

unless the relevant information has already been provided, a final report, no later than 14 days after a corrective or mitigating measure is available, including at least the following:

i)

a description of the vulnerability, including its severity and impact;

(ii) where available, information concerning any malicious actor that has exploited or that is exploiting the vulnerability;

(iii) details about the security update or other corrective measures that have been made available to remedy the vulnerability.

(3)

A manufacturer shall notify any severe incident having an impact on the security of the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that incident via the single reporting platform established pursuant to Article 16.

(4)

For the purposes of the notification referred to in paragraph 3, the manufacturer shall submit:

a)

an early warning notification of a severe incident having an impact on the security of the product with digital elements, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it, including at least whether the incident is suspected of being caused by unlawful or malicious acts, which shall also indicate, where applicable, the Member States on the territory of which the manufacturer is aware that their product with digital elements has been made available;

b)

unless the relevant information has already been provided, an incident notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident, which shall provide general information, where available, about the nature of the incident, an initial assessment of the incident, as well as any corrective or mitigating measures taken, and corrective or mitigating measures that users can take, and which shall also indicate, where applicable, how sensitive the manufacturer considers the notified information to be;

c)

unless the relevant information has already been provided, a final report, within one month after the submission of the incident notification under point (b), including at least the following:

i)

a detailed description of the incident, including its severity and impact;

(ii) the type of threat or root cause that is likely to have triggered the incident;

(iii) applied and ongoing mitigation measures.

(5)

For the purposes of paragraph 3, an incident having an impact on the security of the product with digital elements shall be considered to be severe where:

a)

it negatively affects or is capable of negatively affecting the ability of a product with digital elements to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions; or

b)

it has led or is capable of leading to the introduction or execution of malicious code in a product with digital elements or in the network and information systems of a user of the product with digital elements.

(6)

Where necessary, the CSIRT designated as coordinator initially receiving the notification may request manufacturers to provide an intermediate report on relevant status updates about the actively exploited vulnerability or severe incident having an impact on the security of the product with digital elements.

(7)

The notifications referred to in paragraphs 1 and 3 of this Article shall be submitted via the single reporting platform referred to in Article 16 using one of the electronic notification end-points referred to in Article 16(1). The notification shall be submitted using the electronic notification end-point of the CSIRT designated as coordinator of the Member State where the manufacturers have their main establishment in the Union and shall be simultaneously accessible to ENISA.

For the purposes of this Regulation, a manufacturer shall be considered to have its main establishment in the Union in the Member State where the decisions related to the cybersecurity of its products with digital elements are predominantly taken. If such a Member State cannot be determined, the main establishment shall be considered to be in the Member State where the manufacturer concerned has the establishment with the highest number of employees in the Union.

Where a manufacturer has no main establishment in the Union, it shall submit the notifications referred to in paragraphs 1 and 3 using the electronic notification end-point of the CSIRT designated as coordinator in the Member State determined pursuant to the following order and based on the information available to the manufacturer:

a)

the Member State in which the authorised representative acting on behalf of the manufacturer for the highest number of products with digital elements of that manufacturer is established;

b)

the Member State in which the importer placing on the market the highest number of products with digital elements of that manufacturer is established;

c)

the Member State in which the distributor making available on the market the highest number of products with digital elements of that manufacturer is established;

d)

the Member State in which the highest number of users of products with digital elements of that manufacturer are located.

In relation to the third subparagraph, point (d), a manufacturer may submit notifications related to any subsequent actively exploited vulnerability or severe incident having an impact on the security of the product with digital elements to the same CSIRT designated as coordinator to which it first reported.

(8)

After becoming aware of an actively exploited vulnerability or a severe incident having an impact on the security of the product with digital elements, the manufacturer shall inform the impacted users of the product with digital elements, and where appropriate all users, of that vulnerability or incident and, where necessary, of any risk mitigation and corrective measures that the users can deploy to mitigate the impact of that vulnerability or incident, where appropriate in a structured, machine-readable format that is easily automatically processable. Where the manufacturer fails to inform the users of the product with digital elements in a timely manner, the notified CSIRTs designated as coordinators may provide such information to the users when considered to be proportionate and necessary for preventing or mitigating the impact of that vulnerability or incident.

(9)

By 11 December 2025, the Commission shall adopt delegated acts in accordance with Article 61 of this Regulation to supplement this Regulation by specifying the terms and conditions for applying the cybersecurity-related grounds in relation to delaying the dissemination of notifications as referred to in Article 16(2) of this Regulation. The Commission shall cooperate with the CSIRTs network established pursuant to Article 15 of Directive (EU) 2022/2555 and ENISA in preparing the draft delegated acts.

(10)

The Commission may, by means of implementing acts, specify further the format and procedures of the notifications referred to in this Article as well as in Articles 15 and 16. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 62(2). The Commission shall cooperate with the CSIRTs network and ENISA in preparing those draft implementing acts.

European Commission Interpretation

Guidance of 27 July 2026

The EU Commission guidance of 27 July 2026 provides official interpretation notes on this provision. Each section: summary, key takeaways, and what it means for you in practice.

Section 3.3Open-source software stewards — graduated obligations

Stewards are legal persons that systematically support FOSS intended for commercial activities without placing it on the market (Art. 3(14), Art. 24). The guidance grades the reporting obligations by type of support: purely non-technical support, hosting the infrastructure, or active engineering contributions.

Key takeaways

  • The role applies per FOSS project: the same organisation can be steward for product A and manufacturer for product B (e.g. community vs. paid edition).
  • Non-technical support only (branding, governance, events, donations): no obligation to report actively exploited vulnerabilities — but share information with maintainers and consider voluntary reporting under Art. 15.
  • Infrastructure steward (repos, version control, signing keys): notify ENISA/CSIRTs of severe incidents affecting product security (Art. 14(3)) and inform users where appropriate.
  • Engineering steward (developers, releases, vulnerability handling): report actively exploited vulnerabilities (Art. 14(1)) and inform users (Art. 14(8)).
  • Not-for-profit entities whose earnings serve not-for-profit objectives do not place their FOSS on the market even where it is monetised — steward obligations apply (Example 24: browser funded via search-engine partnerships).

In practice

Clarify per FOSS project what kind of support you provide — governance/branding only, infrastructure (repos, signing keys), or active engineering. That directly determines which reporting and information duties under Article 24 apply to you. The same organisation can be steward for project A and manufacturer for project B.

Section in the guidance overview
Section 9.1Reporting obligations: from 11 Sep 2026, 'becoming aware' and informing users

The Article 14 reporting obligations apply from 11 September 2026 to all products within the CRA's scope — including products placed on the market before 11 December 2027 and products past their support period. 'Becoming aware' means reaching a reasonable degree of certainty after an immediate initial assessment — from that moment the deadlines run (24h early warning, 72h notification, 14 days / 1 month final report).

Key takeaways

  • No retroactive reporting: active exploitation the manufacturer already knew about before 11 Sep 2026 is not reportable; where exploitation only becomes known afterwards, the obligation applies.
  • Third-party components: only an actively exploited vulnerability that is exploitable/exploited in the manufacturer's own product is reportable — otherwise voluntary reporting (Art. 15) plus upstream reporting to the component maintainer (Art. 13(6)).
  • 'Becoming aware' is deliberately aligned with the NIS 2 implementing regulation and the GDPR breach-notification guidelines.
  • Informing users (Art. 14(8)) is risk-based: no indiscriminate disclosure — for sensitive environments, detailed information may be limited to affected users; broader disclosure once fixed, and mandatory disclosure of fixed vulnerabilities under Annex I Part II point (4).
  • Unlike vulnerability handling, the reporting obligations continue to apply after the support period ends.

In practice

Define now who performs the initial assessment of suspected cases and how fast — the 24-hour clock starts at 'reasonable certainty'. The process must be in place by 11 September 2026 and also covers legacy products and products past their support period. Additionally define how you inform users in a risk-based way: affected customers first and targeted, broad disclosure once fixed.

Section in the guidance overview
Browse all guidance chapters

EU Commission Guidance (C(2026) 5252 final) — The guidance reflects the European Commission's interpretation and is not legally binding. An authoritative interpretation of the EU CRA may only be given by the Court of Justice of the European Union.

Common Manufacturer Questions

When does the 24-hour clock start?

When the manufacturer becomes aware that the vulnerability is being actively exploited — not when the CVE is published. Recital 68 clarifies: this concerns cases where a security breach has been caused by malicious actors.

What must the 24-hour early warning contain?

At minimum: affected product, nature of the vulnerability (if known), initial risk assessment. The full analysis follows in the 72-hour notification.

Does the reporting obligation start December 2027 or earlier?

Earlier. Article 14 applies from September 11, 2026 — 15 months before the full CRA application. It also applies to products already on the market before that date.

Who reports for importers and distributors?

The reporting obligation primarily falls on the manufacturer. Importers and distributors must inform the manufacturer when they learn of an actively exploited vulnerability and cooperate in the reporting.

Which deadlines follow the 24-hour early warning?

Within 72 hours, the detailed vulnerability notification follows with nature, severity, and measures taken. The final report is due no later than 14 days after a corrective measure becomes available; for severe incidents, one month after the 72-hour notification.

How do you prepare the reporting process in practice?

Before September 2026: designate reporting owners plus deputies, prepare templates for the 24-hour and 72-hour notifications, establish vulnerability monitoring with alerting, and run the process once end-to-end. Reports go through the single reporting platform to the competent CSIRT and ENISA.

Practice Resources for This Article

Related Recitals

(10)

CRA updates by email

Deadlines, official guidance, and myth-busting fact-checks on the Cyber Resilience Act — compact in our newsletter.

View newsletters

This text is reproduced from Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024. It is provided for informational purposes only and does not constitute legal advice. Only the text published in the Official Journal of the European Union is legally binding. Original text on EUR-Lex