Article 14 reporting obligations apply from 11 September 2026. A manufacturer preparing for that date needs a reliable baseline of product-specific vulnerability and exploitation evidence, not a retrospective spreadsheet assembled during the first live case.
This article does not decide the legal treatment of a particular pre-start fact pattern. It provides the evidence structure counsel and security reviewers need to analyse later events without relying on memory or unsupported provider interpretations.
Freeze the pre-start baseline
For each vulnerability under active investigation before 11 September 2026, record the legal manufacturer, product and versions, component mapping, exploitation evidence, source timestamps, receipt times, assessment times, decision owner, and current conclusion. Preserve the original records and their provenance.
Distinguish awareness of a vulnerability from evidence that it was actively exploited. A vulnerability record, scanner result, patch notice, or proof of concept may justify investigation without establishing the Article 14 definition. State exactly what each item supports.
Separate product scope from the external signal
Trace every signal into the manufacturer’s released product. Record whether the vulnerable code is present, reachable, configured, and relevant to the reported activity. If the evidence concerns another vendor’s product, preserve the relationship and the gap rather than treating the shared component name as a product conclusion.
Give contrary evidence equal visibility. A supplier correction, disputed attribution, clean telemetry period, or changed version map belongs in the same baseline with its checked date and reviewer.
Route later evidence as a new event
After the reporting start, send every new exploitation signal through the ordinary two-track Article 14 triage. Compare it with the baseline, but do not let an old case label decide the new assessment.
Ask whether the evidence concerns the same vulnerability, product version, deployment, malicious activity, and observation period. Record whether it confirms an earlier fact, changes product containment, establishes a new awareness event, or opens the severe-incident test. Keep the comparison and decision time visible.
Keep the transition conclusion narrow
Do not use a pre-start record to close user communication, remediation, contractual notice, sectoral reporting, or another legal duty. Those questions have their own tests and owners. Escalate the legal treatment of contested pre-start evidence to qualified counsel.
At readiness review, a colleague should be able to locate the original evidence, see what the manufacturer concluded before 11 September 2026, and identify the exact condition that would reopen the case afterwards. Contested temporal interpretations belong with qualified counsel.
Continue this workflow with the clock-start analysis and the conflicting-exploitation review.