Article 14 strikes first: The september 2026 CRA Reporting Deadline
Most CRA conversations I have right now orbit around December 2027. That’s the wrong date to focus on first.
Article 14 of the CRA – the reporting obligation for actively exploited vulnerabilities and severe incidents – applies from 11.09.2026. That’s roughly 5 months from now. And 15 months before the rest of the regulation kicks in.
What Article 14 actually requires:
- An early warning to ENISA and your national CSIRT within 24 hours of becoming aware of an actively exploited vulnerability in your product
- A notification with more detail within 72 hours
- A final report within 14 days after a fix or mitigation is available (for actively exploited vulnerabilities; severe incidents get 30 days)
The 24-hour window is the part that keeps me up at night when I look at where most manufacturers are today. To meet it, you need a clear escalation path that lands in front of someone with authority to notify a government body. Manufacturers submit via the EU’s Single Reporting Platform, which routes to both your national CSIRT and ENISA simultaneously.
Most SME product manufacturers have none of this in place. Not because they’re negligent, but because this type of operational security response is genuinely new territory for hardware-adjacent industries.
The uncomfortable part: September 2026 applies to products already on the market. You don’t get a grace period for existing products. If you shipped a connected device in 2024 and a vulnerability in it is actively exploited in October 2026, the 24-hour clock starts.
I’m not saying this to create panic. But if you’re building your CRA roadmap around 2027, you may be structuring the work in the wrong order.
