Article 14 reports start on 11 September 2026. A maker has two early due times after awareness. It must send an early warning without undue delay and within 24 hours. A fuller notice is also due without undue delay and within 72 hours.
The final clock depends on the report track. For a flaw under active attack, it turns on when a fix or risk step is ready. For a severe event, it turns on when the 72-hour event notice is filed.
This guide gives work facts, not legal advice. The duty comes from Regulation (EU) 2024/2847. EU and ENISA guides help explain the work. EU guidance does not bind a court, and site steps can change.
The reporting sequence at a glance
| Stage | Actively exploited vulnerability | Severe incident |
|---|---|---|
| Awareness | Clock starts when the manufacturer becomes aware of the reportable event | Same |
| Early warning | Without undue delay; no later than 24 hours after awareness | Without undue delay; no later than 24 hours after awareness |
| Notification | Without undue delay; no later than 72 hours after awareness | Without undue delay; no later than 72 hours after awareness |
| Final report | No later than 14 days after a corrective or mitigating measure becomes available | Within one month after submission of the 72-hour incident notification |
Both early limits run from awareness. The 72-hour stage is not due 48 hours after the first filing. “Without undue delay” also matters. The outside limit is not leave to wait when the needed facts are ready.
Decide which Article 14 track applies
Article 14 does not make every flaw or security event a must-report case. It sets two tests.
The first is a flaw under active attack. It needs sound proof that a bad actor used the flaw in a system without the owner’s leave. A new flaw, CVE, high risk score, or safety patch does not meet this product test on its own.
The EU guide applies the test to the maker’s product. Weak code may come from a part made by another firm. The EU view says the maker must report if that flaw is under active attack in its product.
The trigger is not met under that view if the weak code cannot be reached in the product. Nor is it met if no attack there is proved. Other vendor, flaw, contract, or free-report steps may still apply.
The second track is a severe event that affects product security. Article 14(5) has two branches. The first covers actual or possible harm to the product’s guard of key data or tasks. The second covers harmful code that entered, ran, or could enter or run in the product or a user’s network.
Possible harm is part of the test. A process that asks only about harm already seen is too narrow.
The report rules start on 11 September 2026. They can cover products in scope that reached the market before 11 December 2027. The ready plan must therefore include old products, not just new ones.
Establish when awareness occurred
The law starts each early clock when the maker “becomes aware.” It does not give a detailed work test for that moment.
The Commission’s final guidance says to assess a suspect event or outside report at once. In its view, awareness starts after a first check gives a sound degree of trust that a trigger is met.
This rule avoids two errors. An unchecked note from a researcher, user, vendor, or news source is not legal awareness by itself. It should still start a prompt check. Once the proof gives enough trust, do not wait for a full cause review.
Record three moments:
- when the alert came in;
- when the first check began; and
- when the trigger was found to be met.
Also save the facts and person behind the awareness choice. A later reviewer can then see why the clock began at that time.
Prepare the 24-hour early warning
Both tracks need an early warning. Send it without undue delay and no later than 24 hours after awareness. It is narrower than the later stages.
For a flaw under active attack, name the Member States where the maker knows the product was offered. Give this list when it applies.
For a severe event, state at least if an unlawful or harmful act is thought to be involved. Name the Member States at issue when this applies.
The early warning is not a full code review. It gives authorities a first alert while the fact review and response go on.
Build the 72-hour notification
The fuller notice is due without undue delay and no later than 72 hours after awareness.
For a flaw under active attack, give known facts about:
- the product at risk;
- the broad type of flaw and attack;
- fixes or risk steps already in place;
- steps users can take; and
- which facts are secret, when this applies.
For a severe event, give known facts about:
- the type of event;
- the first check of it;
- fixes or risk steps already in place;
- steps users can take; and
- which facts are secret, when this applies.
The record will grow through the stages. Keep the early warning and 72-hour check in line. If new proof changes a view, save why.
Apply the correct final-report trigger
The two tracks now split.
For a flaw under active attack, the final report is due no later than 14 days after a fix or risk step is ready. It is not due 14 days after awareness. It is also not due 14 days after the 72-hour notice.
This final report describes the flaw, its level, and its harm. It gives known facts about the bad actor and the security update or other fix.
For a severe event, the final report is due within one month after the 72-hour event notice was filed. The law says “one month,” not “30 days.” The report describes the event, its level, and its harm. It gives the likely threat or cause and steps in place or still under way.
The current ENISA FAQ says the event final is due one month after the “initial notification.” Other key sources use the 72-hour event filing as the start. They include Article 14(4)(c), EU guidance, the EU report page, and Ireland’s NCSC guide. Legal reviews say the same. This guide follows the law’s text.
The case record thus needs two final clock events:
- when a flaw fix or risk step became ready; and
- when the 72-hour severe-event notice was filed.
Determine the coordinating-CSIRT route before an event
Article 14 reports use ENISA’s online platform through the main CSIRT. The notice is most often open to ENISA at the same time. The main CSIRT then shares it with other State CSIRTs at issue.
For an EU-based maker, the main State is most often where most product security choices are made. If no State can be found this way, use the EU site with the most staff.
A maker with no main EU site uses the order in Article 14(7). The route checks its approved agent, then importer, then seller. The last step uses the State with the most users.
Settle the route before a report clock starts. Firm roles and sites are hard to map in a live 24-hour span. Check the current ENISA SRP material before filing. Site steps can change.
Treat user communication as a separate duty
A site filing does not finish the maker’s work to tell users.
Article 14(8) says to tell users at risk about the flaw or event. Tell all users when this is apt. When needed, include fixes or risk steps that users can apply.
This user duty has no separate 24-hour or 72-hour due time in Article 14. EU guidance calls for a fair, risk-based plan. The first note may target users at risk if broad technical detail would aid an attack. That limit does not remove the duty to help users act.
Check other duties on their own. An Article 14 filing does not replace a different law, contract, rule, or user duty from the same facts.
Make the first hours administrative, not exploratory
A useful plan makes key choices and proof ready before an event:
- List products, versions, parts, legal makers, and market States.
- Name who runs both tests, declares awareness, and records the choice.
- Save the Article 14(7) route check and keep it current.
- Name the main and backup filing staff for all hours.
- Prepare forms for each early, 72-hour, and final stage.
- Save proof of alerts, checks, awareness, filings, fixes, and user notes.
- Drill one flaw case and one severe-event case.
These are work tips, not new parts of the law. They make the legal stages easier to run. They do not change them.
ActLume provides a human-controlled workspace for this process. You can review how the workflow works or read the broader CRA Article 14 overview.
Four distinctions worth preserving
- An alert is not always awareness, but it starts a prompt check.
- Both early due times run from awareness.
- The flaw final clock starts when a fix or risk step is ready.
- The severe-event final clock starts when the 72-hour notice is filed.
These lines turn Article 14 into a report path that a team can run.
Continue this workflow with the when does the Article 14 clock start guide and the two-track triage.