AEV
Actively exploited vulnerability
Use the controlling regulation for the definition and threshold; software must not infer the result.
CRA Article 14
Start with the law. Record the decision.
Article 14 of Regulation (EU) 2024/2847 establishes staged, time-critical reporting. Use the linked regulation and current official guidance for the controlling scope and wording.
Official links checked 1 September 2026.
Begin with the occurrence
Assess the occurrence.
The regulation's definitions and thresholds control the assessment. The product design keeps evidence separate from the human legal decision.
SI
Severe incident affecting product security
Use the controlling regulation for the severe-impact conditions. The legal criteria, not a software label, determine the result.
Reporting stages
Staged reporting is time-critical, not a waiting period.
The governing law controls the exact limits after awareness.
First stage
Early warning
Starts from legally relevant awareness and uses the controlling law's current timing language.
Next stage
Notification
Builds on available information, assessment, and mitigation content required for the path.
Final
Vulnerability path
Uses the vulnerability-path trigger and wording in the controlling regulation.
Final
Incident path
Uses the incident-path trigger and wording in the controlling regulation.
General information, not legal advice
Scope, awareness, severity, timing, routing, and required content depend on the controlling law and the facts. Use the official text and qualified legal review for decisions.
Where ActLume fits
The design prepares a handoff; people file in SRP.
The ActLume workflow model keeps intake, reportability, awareness, staged preparation, handoff readiness, and confirmed submission as separate states.
Preparation stays in ActLume. The filer opens ENISA SRP and EU Login separately, transfers selected values, reviews the portal content, submits, and records the result against the case.
See how the workflow fits togetherOfficial sources
Check the current official text.
- Cyber Resilience Act: official EU publication
The controlling text of Regulation (EU) 2024/2847, including Article 14.
- European Commission CRA reporting obligations
The European Commission reporting-obligations summary and current guidance entry points.
- ENISA Single Reporting Platform FAQ
ENISA information about the CRA Single Reporting Platform and its reporting workflow.
ENISA guidance may change as the reporting platform is implemented. Check the official provider page for the current operational position.
Browse practical Article 14 guidesSee it in practice