European Union Cyber Resilience Act Article 14 Reporting Obligations Begin September 11, 2026

The European Commission highlighted on September 1, 2026 that the reporting obligations in Article 14 of Regulation (EU) 2024/2847 (Cyber Resilience Act) will apply from September 11, 2026. Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents affecting product security.

An early warning is required within 24 hours after awareness, followed by a full notification within 72 hours. For actively exploited vulnerabilities, a final report is due no later than 14 days after a corrective or mitigating measure becomes available; for severe incidents, the final report is due within one month after the incident notification.

Reports are submitted once through the CRA Single Reporting Platform, addressed to the CSIRT of the Member State where the manufacturer has its main establishment and, except in particularly exceptional circumstances, made available simultaneously to ENISA. The platform must be operational by September 11, 2026.

This milestone activates Article 14 reporting but does not advance the CRA's general product cybersecurity, conformity-assessment and CE-marking requirements, which apply from December 11, 2027.

Impact

Impact assessment: High.

Key reasons: Article 14 creates binding, time-critical 24-hour, 72-hour and final-report deadlines for manufacturers across the CRA product scope. The European Commission highlighted on September 1, 2026 that the reporting obligations in Article 14 of Regulation (EU) 2024/2847 (Cyber Resilience Act) will apply from September 11, 2026. Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents affecting product security.

Who is affected?

Manufacturers of hardware and software products with digital elements, authorised representatives where applicable, product-security teams, incident-response functions and vulnerability-management teams.

Conclusion:

manufacturers should have reporting governance, escalation criteria, evidence retention and access to the Single Reporting Platform operational before September 11, 2026.