CRA Article 14 Starts 11 September. The 2027 Date Is Not the Clock.

Google's legal pages are what operators are searching this week: CRA reporting and the legislative summary. The headline date most decks still carry is 11 December 2027. That is when the essential requirements and CE marking apply. Article 14 starts 11 September 2026. Tomorrow, if you are reading this on the day we filed it.

High A 24-hour early-warning duty for actively exploited vulnerabilities and severe incidents on products already on the Union market. High because the clock is operational, not because a specific product just popped.

What actually starts on 11 September#

Regulation (EU) 2024/2847, the Cyber Resilience Act, entered into force on 10 December 2024. The Commission's own summary splits the calendar. Chapter IV, on notifying conformity-assessment bodies, applied from 11 June 2026. Reporting obligations in Article 14 apply from 11 September 2026. The rest, including the essential cybersecurity requirements, applies from 11 December 2027.

Article 14 has two triggers. A manufacturer who becomes aware of an actively exploited vulnerability in its product with digital elements must notify. A manufacturer who becomes aware of a severe incident that affects the security of that product must notify. Both go, at the same time, to the coordinator CSIRT in the Member State of the manufacturer's main Union establishment and to ENISA, through the Single Reporting Platform Article 16 told ENISA to build.

The Commission's reporting page is the short version of the clock: early warning within 24 hours of awareness, full notification within 72 hours, then a final report no later than 14 days after a corrective measure is available for an actively exploited vulnerability, or within a month for a severe incident. You file once. The receiving CSIRT shares with the other CSIRTs on whose territory the product was made available, unless it delays on specified cybersecurity grounds.

Already on the market means already in scope#

This is the line that gets dropped from vendor webinars. Products placed on the market before 11 December 2027 are, as a rule, outside the essential-requirements regime unless they are substantially modified after that date. Reporting is the exception. The Commission summary: reporting obligations apply to all products with digital elements that have been made available on the Union market, including those already placed on the market before 11 December 2027.

So a desktop agent you sold in 2025, an IDE plugin on a Union storefront, a hardware box with a management app: if it is a product with digital elements on that market, Article 14 is live on 11 September whether or not you have a 2027 conformity file.

1. 2024-12-10
   Regulation (EU) 2024/2847 enters into force.
2. 2026-07-27
   Commission publishes CRA guidance C(2026) 5252, including how to meet reporting and risk-assessment duties.
3. 2026-09-11
   Article 14 applies. ENISA's Single Reporting Platform is due to be operational the same day.
4. 2027-12-11
   Essential cybersecurity requirements and CE marking apply. This is not the reporting start.

Where an AI product actually sits.#

The CRA does not have an AI exemption. Article 3(1) defines a product with digital elements as a software or hardware product and its remote data processing solutions, including components placed on the market separately. It is in scope when the intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.

Commission guidance C(2026) 5252, published 27 July 2026, lists standalone software such as apps and computer programs, hardware with embedded software, standalone hardware, and combinations sold to work together. Recital language in the regulation already tells manufacturers of high-risk AI systems under Regulation (EU) 2024/1689 to take account of AI-specific vulnerabilities, including data poisoning and adversarial attacks, when they do the CRA risk assessment.

That is the operator cut. An agent product, a coding-assistant desktop build, a device that phones home with a model behind it: treat it as a product with digital elements until counsel tells you it is a service instead. A research checkpoint that never leaves the lab is not "made available on the market." A misconfigured eval that reaches a third-party host is an incident for the lab. It becomes an Article 14 event if the thing you sold has an actively exploited vulnerability or a severe security incident you now know about.

ENISA's July 2026 frontier-AI note tells the same story from the other side: use the Single Reporting Platform, once it works, for the new class of model-driven incidents. The platform is not an AI-Act filing. It is the CRA door.

What to do#

If you make software or hardware that is on the Union market, including an AI product that is sold as software:

1. Decide, in writing, which SKUs are products with digital elements. Use the Commission's July guidance, not a slide that says "SaaS is out." Remote data processing that is part of the product is in the definition.
2. Stand up the 24 / 72 / final-report path before 11 September. Name the person who can file. Register on the Single Reporting Platform. Know the coordinator CSIRT for your main Union establishment.
3. Define awareness. Who is allowed to start the clock: on-call, counsel, a researcher email, a KEV listing. Write it down. The regulation does not pause while you convene.
4. Do not wait for 2027 CE work to invent logging. Article 14 is useless if you cannot tell an exploited vulnerability from noise. ENISA's own frontier-AI note assumes the platform has something to ingest.
5. Keep Article 14 and the AI Act in separate folders. A GPAI incident report is not a CRA early warning. You may owe both. Filing one does not file the other.

The 2027 date is the conformity date. The date that is live is 11 September. A product that already shipped is not grandfathered out of the 24-hour warning.