Step 1 of 3 in Am I ready to file a report?
Research: referenced in the ENISA SME CRA Survey 2026.
Under Article 14 of the EU Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities and severe incidents to their coordinator CSIRT and ENISA — an early warning within 24 hours, a notification within 72 hours and a final report (14 days after a fix for vulnerabilities, one month after the notification for incidents). These obligations have applied since 11 September 2026. Answer the questions below to see how ready you are, where the gaps are, and download a reporting runbook you can keep as evidence.
Legacy products are included. From 11 September 2026 the Article 14 reporting duty applies to all products already on the EU market — not just those placed on the market after that date. The broader CRA obligations (Annex I, conformity assessment, CE marking) only follow from 11 December 2027.
Step 1 of 3
Who reports, and to whom?
Is a named person or team (e.g. a PSIRT) responsible for CRA regulatory reporting?
Article 14 makes the manufacturer accountable. Someone needs to own the decision to notify.
Do you know your coordinator CSIRT and have access to the ENISA single reporting platform?
Reports go to the CSIRT designated as coordinator in your Member State and to ENISA via the single reporting platform.
Do you have an SRP account provisioned with a named submitter and a named backup?
The Single Reporting Platform has been live since 11 Sep 2026 (aligned with Commission guidance C(2026) 5252). Registration is the manufacturer's job — if the only person with access is on holiday, the 24h clock still runs.
Do you publish an up-to-date security contact and a machine-readable intake (security.txt)?
A clear, discoverable contact ensures vulnerability reports actually reach you in time to act.