If you make software or connected equipment, you probably reacted to the Cyber Resilience Act the way most of the market did: the general date is 11 December 2027, so there is time. For the essential cybersecurity requirements, CE marking and conformity assessment, that is right.
For the reporting obligation, it is not.
Article 14 of the Regulation has applied since 11 September 2026. And a derogation few people have read means that this obligation concerns not only future products but everything you have placed on the market so far — including old, unmodified products that will never have to be brought up to the requirements of Annex I.
An asymmetric timetable
Regulation (EU) 2024/2847 entered into force in December 2024, with staged application. Article 71 sets three dates:
- 11 June 2026 — the provisions on conformity assessment bodies;
- 11 September 2026 — Article 14, the manufacturers’ reporting obligations;
- 11 December 2027 — the rest of the Regulation: the essential cybersecurity requirements, technical documentation, the declaration of conformity and CE marking;
The order is unusual. Normally a reporting obligation follows the substantive one: first you are required to comply, then to report when you do not. Here the European legislator reversed the sequence. Since September 2026 you report incidents and vulnerabilities in products that, legally, are not yet subject to the security requirements.
The reason is simple: information about actively exploited vulnerabilities is immediately valuable to authorities, while bringing products into conformity takes years of redesign. The consequence for manufacturers is less simple.
The derogation that changes the calculation
Article 69 contains the transitional provisions. Paragraph 2 states the rule the whole market knows: products placed on the market before 11 December 2027 are subject to the Regulation’s requirements only if they are substantially modified after that date. It is the classic protection of legacy stock found in most technical harmonisation acts.
Paragraph 3 of the same Article expressly derogates from that rule. The obligations in Article 14 apply to all products with digital elements within the scope of the Regulation that were placed on the market before 11 December 2027.
A product sold in 2019 and unmodified since will never have to meet the essential cybersecurity requirements of Annex I. But if tomorrow you find that it has an actively exploited vulnerability, you have 24 hours to notify the authorities.
This is where the mistakes will be made — not out of bad faith, but because all the public communication around the Regulation has been built around the December 2027 date, and the transitional protection of legacy stock is a professional reflex. The derogation in paragraph 3 breaks that reflex, and is visible only to someone who reads the Article to the end.
What triggers the obligation
Article 14 governs two distinct events, with separate regimes.
The actively exploited vulnerability. Not any vulnerability, but one for which you have information that it is actually being exploited. A vulnerability reported by a security researcher, with no sign of exploitation, does not trigger the obligation in paragraph 1, but can be notified voluntarily.
The severe incident having an impact on the security of the product. The severity threshold is defined in paragraph 5, and its wording deserves attention. An incident is severe if it negatively affects or is capable of negatively affecting the product’s ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions; or if it has led or is capable of leading to the introduction or execution of malicious code in the product or in the user’s network and information systems.
No actual harm is required. The potential is enough. The threshold is considerably lower than most manufacturers assume, and the difference matters: for a severe incident, the final report is due within one month of the notification; for an actively exploited vulnerability, within 14 days of a corrective measure becoming available. The event has to be qualified correctly in the first hours, not at the end of the investigation.
The deadlines
Both streams follow the same three-step structure, and the deadlines run from the moment you become aware of the event.
| Actively exploited vulnerability | Severe incident | |
|---|---|---|
| Early warning | 24 hours | 24 hours |
| Notification | 72 hours | 72 hours |
| Final report | 14 days after a corrective measure is available | one month after the notification |
The 24-hour deadline is the one that breaks unprepared organisations — not because it is impossible to meet, but because it requires three things nobody improvises overnight: someone with the competence to qualify the event, operational access to the reporting platform, and a record of the moment the organisation became aware. The last point is the most neglected. Without it, you can prove neither that the deadline was met nor that a delay was justified.
Where to notify
Notifications are filed only electronically, through the single reporting platform run by ENISA, operational since 11 September 2026 at portal.cra-srp.enisa.europa.eu.
Access requires an EU Login account with multi-factor authentication, and registration is done directly on the platform. On registration you select the CSIRT designated as coordinator in the Member State of your main establishment. In Romania, the national CSIRT function is performed by the National Cyber Security Directorate (DNSC).
The main establishment is not a formal criterion. Under Article 14(7), it is the Member State where decisions on the cybersecurity of the products are predominantly taken. For a group whose decision-making is spread across several countries, the determination has to be made and documented in advance. It is not an analysis to carry out within the 24 hours, with an incident under way.
If the main establishment is outside the Union, competence follows a cascade: the Member State of the authorised representative, then of the importer, then of the distributor, then the Member State with the most users.
A practical detail the platform solves but the account does not: registration and activation of multi-factor authentication are done before the first incident. An account created during an incident eats into the 24 hours.
Informing users
Separately from the notification to the authorities, Article 14(8) requires you to inform the affected users and, where appropriate, all users of the vulnerability or incident and of the corrective measures they can take.
The form requirement is the surprising part: the information is given in a structured, machine-readable format that is easily automatically processable. It is a technical obligation of result, not a public relations exercise. A free-text notice on your own website does not satisfy it. The channel has to be built in advance.
If you do not inform users in a timely manner, the notified CSIRTs may do so themselves, where that is proportionate and necessary.
What a mistake costs
Under Article 64(2), failure to comply with the obligations in Article 14 is subject to administrative fines of up to 15 million euros or, for an undertaking, up to 2.5% of total worldwide annual turnover, whichever is higher.
That is the same ceiling as for failing the essential cybersecurity requirements of Annex I. The legislator placed a procedural obligation in the same sanction category as the substantive ones. The choice says something about the weight it gives reporting, and it should count in deciding to treat Article 14 as an internal procedure rather than an information note.
One point in your favour: Article 17(4) expressly provides that the act of notifying does not by itself expose the notifying party to greater liability. The natural reluctance to self-report has no legal basis here.
What to do now
- 1An inventory of products with digital elements
including those placed on the market in the past and not modified since, with their components and dependencies. This is the step the derogation in Article 69(3) makes necessary, and the one most manufacturers have put off.
- 2A documented determination of the main establishment
and identification of the competent CSIRT.
- 3Registration on the single reporting platform
with an EU Login account and multi-factor authentication enabled, tested before the first incident.
- 4An internal procedure for qualifying events
with a decision in the first hours and a record of the moment the organisation became aware.
- 5A channel for informing users
in a structured, machine-readable format.
- 6Clauses with component suppliers and integrators
ensuring you are informed on timelines compatible with the 24 hours.
- 7Alignment with the personal data breach procedure
because an incident that affects confidentiality will usually also be a personal data breach. The obligations are cumulative, not alternative, and the 72-hour deadline runs in parallel on both.
Where we can help
Preparing for Article 14 is not a full Cyber Resilience Act compliance project. It is a narrow package with verifiable outputs: the register of products with digital elements, the note determining the main establishment, the vulnerability and incident handling procedure with the Regulation’s deadlines, the forms for the three notification steps, and the matrix aligning it with the other reporting obligations that apply to you.
To discuss your portfolio, write to office@dataconsulting.ro.
The analysis reflects the legal framework as at 21 September 2026. Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements, published in the Official Journal of the European Union, L series, on 20 November 2024. Supplemented by Commission Delegated Regulation (EU) 2026/881 of 11 December 2025.
Frequently asked questions
When does the Cyber Resilience Act reporting obligation start to apply?
On 11 September 2026. Article 71 of Regulation (EU) 2024/2847 sets a staged application: 11 June 2026 for the provisions on conformity assessment bodies, 11 September 2026 for Article 14 — the manufacturers’ reporting obligations — and 11 December 2027 for the rest of the Regulation: the essential cybersecurity requirements, technical documentation, the declaration of conformity and CE marking.
Does the obligation apply to products sold earlier that we have not modified?
Yes. Article 69(2) provides that products placed on the market before 11 December 2027 are subject to the Regulation’s requirements only if they are substantially modified afterwards. Article 69(3) expressly derogates from that rule for the obligations in Article 14, which apply to all products with digital elements placed on the market before that date. A product sold in 2019 and unmodified since will never have to meet the Annex I requirements, but an actively exploited vulnerability discovered in it has to be notified within 24 hours.
What is an actively exploited vulnerability, and what is a severe incident?
An actively exploited vulnerability is one for which you have information that it is actually being exploited. One reported by a security researcher, with no sign of exploitation, does not trigger the obligation, but can be notified voluntarily. Under Article 14(5), an incident is severe if it negatively affects or is capable of negatively affecting the product’s ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or if it has led or is capable of leading to the introduction or execution of malicious code. No actual harm is required — the potential is enough.
Where is the notification filed, and who is the competent body in Romania?
Notifications are filed only electronically, through the single reporting platform run by ENISA, operational since 11 September 2026. Access requires an EU Login account with multi-factor authentication, created before the first incident. On registration you select the CSIRT designated as coordinator in the Member State of your main establishment; in Romania, the national CSIRT function is performed by the National Cyber Security Directorate (DNSC).