CRA vulnerability reporting
Obligation and clock reference for Regulation (EU) 2024/2847 Article 14(2) actively exploited vulnerability reporting. This page is data only — not a workflow or incident submission form.
These clocks start on 11 September 2026.
Article 14 applies fifteen months before the rest of the Regulation, which is generally applicable from 11 December 2027. It binds products already on the EU market on that date, not only new releases, and a manufacturer who is not yet otherwise CRA-compliant is still subject to it. Being mid-way through conformity work is not a defence to a missed 24-hour window.
Does this apply to you?
These duties fall on the manufacturer of a product with digital elements. Whether you are one is a scope question, and it is the step most often skipped.
Check whether the CRA applies to you — free, no account, computed in your browser and stored nowhere.
- Regulation
- Regulation (EU) 2024/2847 (Cyber Resilience Act)
- Reporting obligations apply from
- 11 September 2026
- In force
- 10 December 2024
- Source
- EUR-Lex CELEX 32024R2847
| Clock | Window | Article |
|---|---|---|
| Early warning notification of an actively exploited vulnerability | 24 hours | Art 14(2)(a) |
| Vulnerability notification | 72 hours | Art 14(2)(b) |
| Final report | 14 days | Art 14(2)(c) |
The eight duties Article 14 creates, each with the Official Journal text it rests on, are in the CRA obligation map. To check a record you have already produced, use record verification.
Calendar dates are sourced from the CRA OJ text as documented in lib/regulations/cra-reporting.ts. Pure SaaS may fall outside CRA product scope; confirm applicability with qualified counsel.