# CRA Article 14 Starts 11 September. The 2027 Date Is Not the Clock. > Article 14 of the EU Cyber Resilience Act applies from 11 September 2026. Manufacturers of products with digital elements on the Union market file an early warning within 24 hours of an exploited vulnerability or a severe incident, then a full notification within 72 hours. The rest of the CRA waits until December 2027. Reporting already covers shipped products. Source: https://hackerlogs.com/blog/cra-article-14-reporting Published: 2026-09-10 ## Key takeaways - Article 14 is the first CRA duty that bites. Essential requirements and CE marking wait until 11 December 2027. Reporting does not. - The Commission is explicit: reporting covers every product with digital elements already made available on the Union market, including those placed before 2027. - The clock is 24 hours to an early warning and 72 hours to a full notification, through ENISA's Single Reporting Platform, to the coordinator CSIRT and ENISA at once. - Standalone software is in scope when it is placed on the market and can talk to a device or a network. That is an AI desktop app and an agent product, not a research checkpoint. - ENISA's frontier-AI note says to use the same platform for the new class of model-driven incidents. A 2027 roadmap does not pause a 24-hour clock. Google's legal pages are what operators are searching this week: [CRA reporting](https://digital-strategy.ec.europa.eu/en/policies/cra-reporting) and the [legislative summary](https://digital-strategy.ec.europa.eu/en/policies/cra-summary). The headline date most decks still carry is 11 December 2027. That is when the essential requirements and CE marking apply. [Article 14](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847) starts 11 September 2026. Tomorrow, if you are reading this on the day we filed it. A 24-hour early-warning duty for actively exploited vulnerabilities and severe incidents on products already on the Union market. High because the clock is operational, not because a specific product just popped. Three panels for CRA Article 14: the 11 September 2026 reporting start versus the 2027 CE-mark date, a 24-hour and 72-hour filing clock through ENISA's Single Reporting Platform, and the fact that shipped software and agent products on the Union market are already in scope. ## What actually starts on 11 September Regulation (EU) 2024/2847, the Cyber Resilience Act, entered into force on 10 December 2024. The Commission's own summary splits the calendar. Chapter IV, on notifying conformity-assessment bodies, applied from 11 June 2026. Reporting obligations in Article 14 apply from 11 September 2026. The rest, including the essential cybersecurity requirements, applies from 11 December 2027. Article 14 has two triggers. A manufacturer who becomes aware of an actively exploited vulnerability in its product with digital elements must notify. A manufacturer who becomes aware of a severe incident that affects the security of that product must notify. Both go, at the same time, to the coordinator CSIRT in the Member State of the manufacturer's main Union establishment and to ENISA, through the Single Reporting Platform Article 16 told ENISA to build. The Commission's reporting page is the short version of the clock: early warning within 24 hours of awareness, full notification within 72 hours, then a final report no later than 14 days after a corrective measure is available for an actively exploited vulnerability, or within a month for a severe incident. You file once. The receiving CSIRT shares with the other CSIRTs on whose territory the product was made available, unless it delays on specified cybersecurity grounds. > The essential requirements wait. Reporting does not. The Commission said so in the July 2026 guidance announcement and in the legislative summary. A 2027 CE-mark programme is not an Article 14 programme. ## Already on the market means already in scope This is the line that gets dropped from vendor webinars. Products placed on the market before 11 December 2027 are, as a rule, outside the essential-requirements regime unless they are substantially modified after that date. Reporting is the exception. The Commission summary: reporting obligations apply to all products with digital elements that have been made available on the Union market, including those already placed on the market before 11 December 2027. So a desktop agent you sold in 2025, an IDE plugin on a Union storefront, a hardware box with a management app: if it is a product with digital elements on that market, Article 14 is live on 11 September whether or not you have a 2027 conformity file. ## Where an AI product actually sits. The CRA does not have an AI exemption. Article 3(1) defines a product with digital elements as a software or hardware product and its remote data processing solutions, including components placed on the market separately. It is in scope when the intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. [Commission guidance C(2026) 5252](https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation), published 27 July 2026, lists standalone software such as apps and computer programs, hardware with embedded software, standalone hardware, and combinations sold to work together. Recital language in the regulation already tells manufacturers of high-risk AI systems under Regulation (EU) 2024/1689 to take account of AI-specific vulnerabilities, including data poisoning and adversarial attacks, when they do the CRA risk assessment. That is the operator cut. An agent product, a coding-assistant desktop build, a device that phones home with a model behind it: treat it as a product with digital elements until counsel tells you it is a service instead. A research checkpoint that never leaves the lab is not "made available on the market." A misconfigured eval that reaches a third-party host is an incident for the lab. It becomes an Article 14 event if the thing you sold has an actively exploited vulnerability or a severe security incident you now know about. ENISA's July 2026 [frontier-AI note](https://www.enisa.europa.eu/sites/default/files/2026-07/ENISA%20view%20on%20cybersecurity%20in%20the%20frontier%20AI%20era_en_0.pdf) tells the same story from the other side: use the Single Reporting Platform, once it works, for the new class of model-driven incidents. The platform is not an AI-Act filing. It is the CRA door. > The 24-hour clock starts when the manufacturer becomes aware, not when a journalist files. If your detection cannot tell an exploited vulnerability from a crash dump, you do not have an Article 14 process. You have a hope. ## What to do If you make software or hardware that is on the Union market, including an AI product that is sold as software: 1. Decide, in writing, which SKUs are products with digital elements. Use the Commission's July guidance, not a slide that says "SaaS is out." Remote data processing that is part of the product is in the definition. 2. Stand up the 24 / 72 / final-report path before 11 September. Name the person who can file. Register on the Single Reporting Platform. Know the coordinator CSIRT for your main Union establishment. 3. Define awareness. Who is allowed to start the clock: on-call, counsel, a researcher email, a KEV listing. Write it down. The regulation does not pause while you convene. 4. Do not wait for 2027 CE work to invent logging. Article 14 is useless if you cannot tell an exploited vulnerability from noise. ENISA's own frontier-AI note assumes the platform has something to ingest. 5. Keep Article 14 and the AI Act in separate folders. A GPAI incident report is not a CRA early warning. You may owe both. Filing one does not file the other. The 2027 date is the conformity date. The date that is live is 11 September. A product that already shipped is not grandfathered out of the 24-hour warning. ## Sources - [Cyber Resilience Act - Reporting obligations](https://digital-strategy.ec.europa.eu/en/policies/cra-reporting) (2026-09-10) - [The Cyber Resilience Act - Summary of the legislative text](https://digital-strategy.ec.europa.eu/en/policies/cra-summary) (2026-07-27) - [Commission publishes new guidance to support timely Cyber Resilience Act implementation](https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation) (2026-07-27) - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847) (2024-11-20) - [ENISA's view on Cybersecurity in the Frontier AI Era](https://www.enisa.europa.eu/sites/default/files/2026-07/ENISA%20view%20on%20cybersecurity%20in%20the%20frontier%20AI%20era_en_0.pdf) (2026-07-01)