CRA Article 14 Reporting: 24/72-Hour Obligations

Last updated: 24 October 2026

At a Glance

The Article 14 reporting obligation has applied since 11 September 2026; legacy products on the EU market are included.
Deadlines: 24-hour early warning and 72-hour notification; the final report is due within 14 days for actively exploited vulnerabilities and within 1 month for severe incidents.
Reports are submitted through ENISA’s Single Reporting Platform to the coordinator CSIRT; for non-EU manufacturers, the recipient is the Member State of the authorised representative.
Micro and small enterprises are not exempt; the only relief concerns penalties for the 24-hour stage.
Setup (playbook, SRP registration, inventory, drill) typically takes 2–3 weeks.

The CRA Article 14 reporting obligation has applied since 11 September 2026. Every manufacturer with a product with digital elements on the EU market must submit an early warning within 24 hours and a full notification within 72 hours of becoming aware of an actively exploited vulnerability or a severe incident affecting product security. Nesil Teknoloji makes this infrastructure operational through a 2–3 week setup engagement — including the reporting playbook, ENISA Single Reporting Platform (SRP) registration, identification of the recipient CSIRT, legacy product inventory and a reporting drill — and, on request, maintains it with a 24/7 on-call reporting service.

What Does the Obligation Say?

Stage	Deadline	Content
Early warning	24 hours	Initial notification from the moment of awareness
Notification	72 hours	Detailed notification, impact assessment, measures taken
Final report	14 days / 1 month	14 days after a corrective measure for an actively exploited vulnerability; 1 month for a severe incident

Reports are sent through ENISA’s Single Reporting Platform to the coordinator CSIRT of the relevant Member State and shared simultaneously with ENISA. For a manufacturer not established in the EU, the recipient is, as a rule, the CSIRT of the Member State where the authorised representative is located — which makes the choice of representative an operational decision. For setting this up, see our EU Authorised Representative Coordination service.

Who and Which Products Are Covered?

All in-scope products made available on the EU market — including legacy products sold before 11 September 2026. Micro and small enterprises are not exempt from reporting; the only relief concerns penalties at the 24-hour early warning stage. The prerequisite for meeting the obligation is knowing which component is in which product: SBOM and vulnerability monitoring infrastructure must already be in place.

The Reporting Infrastructure We Set Up

Reporting playbook — roles and RACI, decision thresholds (distinguishing vulnerabilities, exploitable vulnerabilities, actively exploited vulnerabilities and severe incidents), deadline timers.
SRP registration and recipient CSIRT set-up — access to the Single Reporting Platform and identification of the recipient based on the authorised representative’s country.
Legacy product inventory — a record of products, versions and support status already on the EU market.
Vulnerability monitoring and SBOM matching — automated matching of CVE tracking against the product’s software bill of materials.
Reporting form templates — ready-made Turkish–English templates for the early warning, notification and final report.
Tabletop exercise — measuring response times on a scenario and validating the playbook.

Process and Timeline

Setup typically takes 2–3 weeks: current state and product inventory; playbook and SRP/CSIRT set-up; drill and go-live. Monthly vulnerability monitoring and a 24/7 on-call reporting service are then available as optional services.

On-Call Reporting (24/7)

The 24-hour window is hardest to meet for events triggered outside business hours. The on-call service covers receiving incident/vulnerability reports, assessing decision thresholds, drafting the early warning and supporting submission via the SRP.

Frequently Asked Questions

Don’t we have until 2027?

11 December 2027 applies to Annex I as a whole; however, Article 14 has applied since 11 September 2026 and also covers legacy products. A manufacturer without reporting infrastructure risks missing the 24-hour deadline at the very first incident.

Where are reports submitted?

Through ENISA’s Single Reporting Platform, to the coordinator CSIRT of the relevant Member State. If you are not established in the EU, the recipient is, as a rule, the CSIRT of the country where your authorised representative is located.

What if we don’t have an authorised representative?

Appointment is not mandatory, but it clarifies the reporting recipient and communication with market surveillance. With our network of EU-based representatives, we design the appointment and the scope of the mandate together with you.

Does every vulnerability have to be reported?

No. Reporting applies to actively exploited vulnerabilities and severe incidents. The decision thresholds in the playbook distinguish between vulnerabilities, exploitable vulnerabilities and active exploitation, define the criteria for severe incidents and also prevent unnecessary reports.

Official Sources

Preliminary Meeting for Setup

The obligation is already in force. To have your current state assessed: Request a Quote · Ankara +90 312 911 46 40 · Istanbul +90 216 232 24 33