The CRA Article 14 clock starts when an initial assessment gives the manufacturer a reasonable degree of certainty that the reporting trigger is present. A suspicious signal alone does not settle that question. Full forensic confirmation is not required either. The decision sits between those two points.
For an actively exploited vulnerability or a severe incident affecting product security, awareness starts the 24-hour and 72-hour outer limits. Both stages are also due without undue delay. Article 14 applies from 11 September 2026.
Use a three-part threshold
Ask three questions about the evidence available now:
- Does the event relate to the manufacturer’s product?
- Does the evidence support an actively exploited vulnerability or a severe incident affecting that product’s security?
- Has the initial assessment reached a reasonable degree of certainty?
If the answer to all three is yes, treat the awareness threshold as reached. Do not move it to the date of a later legal meeting, management approval or final technical report. Those events may confirm the analysis, but they do not replace the earlier evidence.
If one answer is no, state which part is missing. Name the next fact that would change the decision and who is responsible for checking it. This keeps an open assessment from becoming an undefined pause.
Treat the signal as an input
The Commission’s non-binding guidance lists many ways that a possible trigger may reach a manufacturer. They include a responsible disclosure, the manufacturer’s own testing, a third-party report, information from a customer or user, a media report and observed malicious activity.
Each is an input to the initial assessment. Its arrival time matters, but receipt does not answer every threshold question by itself. For example:
| Signal | Question still to answer |
|---|---|
| Researcher report | Does it concern the manufacturer’s product, and is active exploitation supported? |
| Automated alert | Is the product match sound, and what activity did the alert observe? |
| Customer incident | Did the event compromise the product’s security, and is the incident severe? |
| Media report | Can the report be connected to the product and checked against available evidence? |
This is not permission to ignore a weak or incomplete signal. It is a reason to assess it promptly and record what the signal did and did not establish.
Do not turn assessment into delay
The Commission guidance puts the emphasis on prompt action to complete the initial assessment. Independent legal and reporting analyses reach the same practical conclusion: once the available evidence provides reasonable certainty, an open investigation is not a reason to wait for complete forensic proof.
Keep these moments separate:
- The signal arrives.
- The initial assessment reaches reasonable certainty.
- Later work confirms the root cause, full scope or final impact.
The first moment starts the assessment. The second is the awareness decision. The third can improve later reporting, but it should not silently reset the second.
Apply the test to difficult cases
When signals conflict, test the disputed point instead of choosing the most convenient timestamp.
Suppose a supplier reports exploitation, but the affected component has not yet been matched to a shipped product. The open issue is product connection. Once the manufacturer can connect the evidence to its product and the other parts of the trigger are supported with reasonable certainty, the threshold is reached.
Suppose an automated system reports activity that could be hostile or benign. The open issue is what the activity establishes. A prompt assessment may reject the alert, keep it under review or reach reasonable certainty. The legal question is based on the evidence at each decision point, not on the label attached by the tool.
Suppose technical reviewers reach reasonable certainty before counsel joins the case. Counsel may advise on the analysis and reporting. The later meeting should not replace an earlier awareness moment that the available evidence already supports.
Connect the decision to the reporting windows
Once awareness is established, calculate the 24-hour and 72-hour outer limits from that instant in UTC. Keep the words “without undue delay” beside both limits. The outer limit is not a safe waiting target.
The early warning can be short because the law expects information to develop. The 72-hour stage carries a fuller assessment. Later final reports follow their own statutory triggers, so do not derive every Article 14 deadline from awareness.
The threshold decision and the evidence record are related but distinct tasks. This page answers when awareness exists. The awareness-timestamp guide explains how to preserve the source times, evidence, decision owner and later corrections. If evidence was already in hand before the start date, use the pre-deadline awareness baseline before applying this test to later events. For the full sequence, use the Article 14 reporting-stage guide.
Legal counsel should review difficult cases. This article explains an operational reading of the law and non-binding Commission guidance; it is not legal advice.