What changed on 11 September 2026?
Article 14 reporting obligations became applicable for manufacturers on 11 September 2026. The European Commission states that manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements.
The reporting stages
The process begins with an early warning within 24 hours of awareness, followed by a fuller notification within 72 hours. A later final report is also required, with timing depending on whether the event is an actively exploited vulnerability or a severe incident.
Where do reports go?
Official notifications are submitted through ENISA's CRA Single Reporting Platform. CyberAct24 does not replace the official platform. It helps teams prepare and structure the information internally before human review and submission.
The operational problem
The regulatory deadline is short. Teams need an internal process for identifying when awareness occurred, who owns the case, what product is affected, which facts are confirmed, what is still unknown, what mitigations exist and who is authorised to review and submit.