Article 14 reports start on 11 September 2026. Before that date, a maker needs sound proof for each product and flaw. It should not build the first record from memory during a live case.

This guide does not decide the law for a given set of early facts. It gives legal and security teams a proof plan for later events. They can then rely on records, not memory or a vendor’s unsupported view.

Freeze the pre-start baseline

For each flaw under review before the start date, record:

  • the legal maker;
  • the product and versions;
  • the part map;
  • proof of active attack;
  • source and receipt times;
  • review times;
  • the choice owner; and
  • the current result.

Keep each source record and where it came from.

Knowing about a flaw is not the same as knowing it is under active attack. A flaw record, scan, patch note, or test may justify a review. It may not meet the Article 14 term. State what each item proves.

Separate product scope from the external signal

Trace each alert into a product that the maker released. Is the weak code in it? Can the code be reached? Is it set up to run? Does it relate to the attack seen?

If the proof is about another firm’s product, keep that link and the gap. A shared part name does not prove that your product is at risk.

Make proof that points the other way just as clear. This may be a vendor fix to its claim, a disputed source, a clean log period, or a new version map. Save it with the check date and reviewer.

Route later evidence as a new event

After the start date, send each new sign of attack through the normal two-track check. Compare it with the old record. Do not let an old case label decide the new result.

Ask if the proof covers the same flaw, version, use, attack, and time span. Does it confirm an old fact or change product scope? Does it start a new awareness event or open the severe-event test? Save the check and time of choice.

Keep the transition conclusion narrow

Do not use an early record to close other duties. User notice, fixes, contract alerts, and reports under other laws have their own tests and owners. Ask a skilled lawyer to decide any dispute about how the law treats early facts.

At a readiness check, a peer should find the source proof and the maker’s result before the start date. The peer should also see the exact fact that would reopen the case. A skilled lawyer should decide disputes about when a rule applies.

Continue this workflow with the clock-start analysis and the conflicting-exploitation review.