Under Article 14 of the EU Cyber Resilience Act, a manufacturer must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a fuller notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available. Article 14 applies from 11 September 2026.
Definitions
An actively exploited vulnerability is one the manufacturer knows is being used by an attacker against a product. Recital 68 of the regulation separates this from flaws found through good faith testing, which are not subject to mandatory notification. The clock starts when the manufacturer becomes aware, not when a CVE is published.
The three reports
| Report | Deadline | Minimum content |
|---|---|---|
| Early warning | Within 24 hours of awareness | Where applicable, the Member States where the product is available |
| Vulnerability notification | Within 72 hours of awareness | General product information, nature of the exploit and flaw, measures taken, measures users can take |
| Final report | No later than 14 days after a fix or mitigation is available | Description, severity and impact, any known attacker information, details of the update |
The 72 hour and final reports are due unless the information has already been provided. The notification also asks the manufacturer to indicate how sensitive it considers the information to be.
Who receives it
Notifications go at the same time to the CSIRT designated as coordinator and to ENISA, through the single reporting platform created under Article 16. The CSIRT may ask for an intermediate report on status updates.
How an SBOM helps the 24 hour clock
You cannot report a product as affected until you know it is. An SBOM per release, searchable by component, turns "do we ship this?" from a day of messages into a query. The early warning has to name where the product is available, so release and market records matter as well.
- Keep a component index per release.
- Keep a record of which releases are available in which countries.
- Name a person who can submit the report, and a backup.
- Write the early warning template before you need it.
- Practise once a quarter.
Users must be told too
Article 14(8) says that after becoming aware, the manufacturer must inform affected users, and where appropriate all users, of the vulnerability and of any risk mitigation and corrective measures, where appropriate in a structured, machine readable format. If a manufacturer fails to do so in a timely manner, the CSIRTs may inform users.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how quickly you need to know which of your products contain the component.
Quick check
Does the 24 hour clock start when the CVE is published?
No. The text says it starts when the manufacturer becomes aware of the actively exploited vulnerability.
Does this reporting duty apply today?
Article 14 applies from 11 September 2026. Other obligations apply from 11 December 2027. Confirm how it applies to your product with counsel.
Safeguard offers zero-day discovery, SBOM and dependency scanning and reachability analysis, which can shorten the step of working out which products contain an affected component. A free scan shows how that inventory looks.
Sources
- Regulation (EU) 2024/2847, EUR-Lex, Article 14, Recital 68, Article 71
Last reviewed: 19 October 2026.
