Article 14 of the EU Cyber Resilience Act became applicable on 11 September 2026. From that date a manufacturer must report actively exploited vulnerabilities and severe incidents. The rest of the regulation applies from 11 December 2027. If you are a small software vendor and you are not sure the CRA applies to you, the answer is in the regulation's text, published in the Official Journal of the European Union on 20 November 2024 as Regulation (EU) 2024/2847.
This post separates what is binding law from what is interpretation, using the Official Journal text.
What's affected
Article 71 sets three dates:
- 11 June 2026: Chapter IV (Articles 35 to 51), the rules for conformity assessment bodies, applies.
- 11 September 2026: Article 14, the reporting obligations, applies.
- 11 December 2027: the regulation applies in full.
Article 69(3) matters for older products: Article 14 applies to all in-scope products placed on the market before 11 December 2027. Under Article 69(2), those older products are otherwise subject to the regulation only if they undergo a substantial modification from that date.
Scope comes from Article 2(1): products with digital elements "made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network." Recitals 11 and 12 address cloud. A remote data processing solution is in scope when the manufacturer designed it and "the absence of which would prevent the product with digital elements from performing one of its functions." The recital gives the example of a mobile app that needs a manufacturer-provided API. A standalone cloud service "designed and developed outside the responsibility of a manufacturer of a product with digital elements" is not in scope, and recital 12 says NIS 2 applies to SaaS, PaaS and IaaS providers that are medium-sized or larger.
Recitals explain the text. The articles and annexes bind.
How to check if you're exposed
Answer four questions for each thing you ship:
- Is it software or hardware that connects, directly or indirectly, to a device or network?
- Is it made available on the EU market?
- If it is a service, would the product stop doing one of its functions without it?
- Is it covered by one of the exclusions in Article 2(2) to (7), such as certain medical devices or certified aviation products?
Write the answers down, with the date. The Commission's non-binding guidance of 27 July 2026 addresses remote data processing and free and open source software in more detail, and says particular attention has been paid to microenterprises and SMEs.
What to do now
- Run the scoping questions and keep the record.
- Set up the Article 14 path now: who decides that a vulnerability is actively exploited, who files the early warning within 24 hours, the vulnerability notification within 72 hours, and the final report within 14 days after a corrective measure is available.
- Start an SBOM per release. Annex I, Part II, point 1 requires an SBOM "in a commonly used and machine-readable format covering at the very least the top-level dependencies."
- Choose a support period. Article 13(8) says it shall be at least five years unless the product is expected to be in use for less time, and security updates must stay available for at least 10 years or the rest of the support period, whichever is longer (Article 13(9)).
- Publish a coordinated vulnerability disclosure policy. Annex I, Part II, point 5 requires one.
- Document third-party component due diligence, including open source (Article 13(5)).
Why it matters
Fines are set in Article 64. Failing the essential requirements or Articles 13 and 14 can bring fines of up to EUR 15 000 000 or 2.5 percent of worldwide annual turnover, whichever is higher.
The practical risk for a small vendor is not the fine. It is arriving at December 2027 with no scoping record, no reporting path and no SBOM habit, while customers ask for all three.
Quick check
Which CRA article applies from 11 September 2026?
Article 14, the reporting obligations for actively exploited vulnerabilities and severe incidents.
Does Article 14 apply to products placed on the market before 11 December 2027?
Yes. Article 69(3) applies Article 14 to all in-scope products placed on the market before that date.
