On 11 September 2026, Article 14 of the EU Cyber Resilience Act began to apply, and ENISA's Single Reporting Platform opened for mandatory notifications. That date turned a long running policy conversation into a legal one for some manufacturers, and left everyone else wondering which parts apply to them. The answer depends on what you sell, where, and to whom.
This post sorts the main sources into binding law, binding on a narrow group, and guidance.
What's affected
| Source | Status | Who it binds | What it says about vulnerability handling |
|---|---|---|---|
| EU Cyber Resilience Act, Regulation 2024/2847, Article 14 | Binding since 11 Sep 2026 | Manufacturers of products with digital elements in scope | Notify actively exploited vulnerabilities and severe incidents: early warning in 24 hours, notification in 72 hours, final report no later than 14 days after a corrective or mitigating measure is available |
| CRA Article 13(8) and Annex I Part II | Binding from 11 Dec 2027 | Same manufacturers | Handle vulnerabilities for the support period; policy on coordinated vulnerability disclosure; contact address for reports; publish information on fixed vulnerabilities after an update; free security updates |
| CRA Article 15 | Voluntary | Anyone | Voluntary reporting to a CSIRT or ENISA; no extra obligations arise from reporting |
| NIS2 Directive 2022/2555, Article 21(2)(e) | Directive: national law binds entities | Essential and important entities, as transposed | Measures include "vulnerability handling and disclosure" |
| NIS2 Article 12 | Directive | Member States | Designate a CSIRT as coordinator for coordinated disclosure; allow anonymous reports to it |
| UK PSTI security requirements | Binding since 29 Apr 2024 | Manufacturers of consumer connectable products | Provide a point of contact for security reports, and state when reporters will get acknowledgment and status updates |
| CISA BOD 20-01 | Binding on US federal agencies only | Federal civilian agencies | Publish a VDP with scope, testing rules, reporting method, good faith commitment, and track response metrics |
| NIST SP 800-216 (May 2023) | Guidance for federal use | Federal agencies | Federal vulnerability disclosure framework, aligned with ISO/IEC 29147 and 30111 |
| ISO/IEC 29147 and 30111 | Voluntary standards | Nobody by themselves | Process for receiving and publishing, and for internal handling |
| RFC 9116 | Informational RFC | Nobody | The security.txt format |
Three precision points matter. First, the CRA's deadline for Article 14 reporting covers actively exploited vulnerabilities and severe incidents, not every vulnerability report. Second, a directive such as NIS2 does not bind a company directly until a Member State transposes it, so check your national law. Third, the CRA's maximum administrative fine for failing Article 13, Article 14 or Annex I duties is EUR 15 000 000 or 2.5 percent of worldwide annual turnover, whichever is higher, under Article 64(2).
ENISA's FAQ adds that a manufacturer is not required to retrospectively report an exploited vulnerability it already knew about before 11 September 2026, but must report if it becomes aware of exploitation after that date, even if the vulnerability was already known.
How to check if you're exposed
Work through these in order and stop where the answer is no.
- Do you sell or distribute software or a connected product into the EU? If yes, read the CRA's scope and exclusions against your product.
- Do you operate as an essential or important entity under your country's NIS2 law? If yes, vulnerability handling belongs in your security measures.
- Do you make a consumer connectable product for the UK market? If yes, the PSTI contact requirement applies to you.
- Do you sell to US federal agencies? BOD 20-01 binds the agency, not you, but your customer will expect a compatible process.
- None of the above? Your obligation is contractual and reputational. Customers may still require a policy.
What to do now
- Record your answers in a register entry per regime, with an owner and a review date.
- For the CRA, name who would file an Article 14 notification and how that person reaches the ENISA platform.
- Publish the contact and policy (see the VDP template post). It is useful under every regime.
- Map your existing process to each row's wording, and write down gaps without trying to fix everything at once.
How to avoid this trap
- Do not describe a guidance document as a legal duty in sales material. "ISO 29147 aligned" is not "legally required."
- Do not assume that a vulnerability policy satisfies Article 14. The notification duty needs a procedure for establishing awareness and filing within hours.
- Do not treat a directive as national law. Check the Member State's transposition.
- Re-read the rows when a regime changes. Some dates above are in the future and may be amended by delegated or implementing acts.
Why it matters
A small manufacturer can be more exposed than a large one, because the 24 hour clock does not shrink with headcount. The same contact address and policy serve a CRA manufacturer, a UK device maker and an enterprise supplier answering a questionnaire. Doing it once and sourcing it correctly is cheaper than reworking it for each customer.
Try it yourself
Create one register entry per row that applies to you, with the exact article number, a status (binding, directive, guidance), and your evidence. The walkthrough below shows a risk register that can hold such entries.
Click through it at your own pace, or open it full screen.
Quick check
Is CISA BOD 20-01 binding on private software vendors?
No. It binds US federal civilian agencies. Vendors may follow it as guidance, and agencies may ask for compatible practices.
When does the CRA's coordinated vulnerability disclosure policy requirement apply?
From 11 December 2027, under Annex I Part II item 5. Article 14 reporting has applied since 11 September 2026.
Sources
- Regulation (EU) 2024/2847 (CRA): Articles 13, 14, 15, 64, 71, Annex I, Annex II
- ENISA Single Reporting Platform FAQ
- Directive (EU) 2022/2555 (NIS2), Articles 12 and 21
- NCSC: Smart devices law (PSTI)
- DSIT: Cyber security of consumer IoT manufacturer survey
- CISA BOD 20-01
- NIST announcement of SP 800-216, May 2023
