The deadlines under Article 14 CRA

Article 14 of Regulation (EU) 2024/2847 has two triggers: an actively exploited vulnerability in a product with digital elements, and a severe security incident affecting the security of the product. Both run through the same three stages — early warning, detailed notification, final report.

The early warning is due within 24 hours, the detailed notification within 72 hours. Both deadlines run from the moment the manufacturer becomes aware. Not from confirmation, not from reproduction in the lab, not from the end of the internal assessment.

The early warning is allowed to be thin. In essence it requires who is reporting, which product in which version is affected, what this is about and in which Member States the product was made available. Missing details are supplied later — a late notification, by contrast, cannot be made up for.

This is the difference that is regularly misunderstood in practice. For an actively exploited vulnerability the final report is due within 14 days — counted from the point at which a corrective or mitigating measure is available. As long as none is available, no deadline runs for the final report at all.

For a severe security incident the final report is due within one month — counted from the submitted 72-hour notification. Here the deadline hangs on an action of the manufacturer, not on the progress of remediation.

Anyone treating both cases the same will miscalculate one of them. That is why the reporting assistant deliberately shows no countdown for the final report on the vulnerability path as long as the remedy availability date has not been entered, and instead states that the deadline has not started.

Between the fixed stages, the coordinating CSIRT may request an intermediate report with a status update at any time. That request has no fixed deadline in the regulation, but it arrives unannounced — anyone documenting their status anyway answers it in minutes.

Independently of that, submitted notifications must be updated as soon as new findings emerge. A notification is therefore not a one-off act but a running file — which is precisely why the assistant also produces a case log.