Article 14 reporting explained: 24 hours, 72 hours, 14 days

Article 14 is the first CRA obligation with a hard date — 11 September 2026 — and it is the one machine builders should prepare for first. It is a reporting duty, and it is narrower than "full compliance", but the clocks are short and they start the moment you become aware of a problem.

What triggers a report

Two things oblige you to report: an actively-exploited vulnerability in your product, or a severe incident affecting the security of your product. "Actively exploited" is the key phrase — a vulnerability that exists but is not being exploited does not, by itself, start the Article 14 clock (though you still have handling duties from December 2027).

The cascade — and where the clock starts

Reporting goes through ENISA’s Single Reporting Platform, and the timeline runs from when you become aware:

• Early warning — within 24 hours of awareness, indicating where applicable the Member States where the product is available or affected.
• Notification — within 72 hours of awareness, with general information on the product, the nature of the exploit or vulnerability, and any corrective or mitigating measures taken and available to users.
• Final report — for a vulnerability, no later than 14 days after a corrective or mitigating measure is available; for an incident, within one month of the 72-hour notification.

Note the nuance most guides miss: the final-report deadline is not "14 days from awareness". For vulnerabilities it is anchored to when a fix or mitigation becomes available; for incidents it is one month after the 72-hour notification. Getting this wrong in either direction is a compliance risk.

You also have to inform users

Beyond reporting to authorities, once you become aware you must inform impacted users about the vulnerability or incident and, where necessary, about risk mitigations and corrective measures — where appropriate in a structured, machine-readable format. A published CSAF security advisory can serve this purpose.

It applies to machines already in the field

Article 14 is effectively retroactive: it covers products already on the market. For most machine builders that means a fielded fleet with little or no active monitoring — which is exactly why readiness, not paperwork, is the near-term priority. You cannot report on a 24-hour clock if you do not yet know which fielded products contain the affected component.

What "readiness" looks like in practice

Being ready for Article 14 means three capabilities: a live inventory of which products and versions are deployed where; correlation of your components against vulnerability sources (EUVD, NVD, the CISA KEV catalogue) so an actively-exploited issue surfaces immediately; and a reporting workflow mapped to the platform so the 24h / 72h / final cascade is a matter of review and sign-off, not a scramble. AI can draft; a human always reviews and signs.

That is precisely the gap the Resilic readiness kit closes — and you can start with the free scope check to see where you stand.