EU CRA Article 14: The 24-Hour Exploited-Vulnerability Reporting Rule, Explained

A plain-language walkthrough for a solo founder or small software vendor who just found out this applies to them and has no compliance team to hand it to.

The short version: if you sell software (or a connected/IoT product) into the EU and you learn one of your dependencies has an actively exploited vulnerability, you have 24 hours to send ENISA (and your national CSIRT) an early-warning notification, a follow-up within 72 hours, and a final report within 14 days of the fix being available.

Who does this actually apply to?

The Cyber Resilience Act (Regulation (EU) 2024/2847) covers "products with digital elements" placed on the EU market — which in practice means almost any software or connected hardware sold to EU customers, not just critical infrastructure or big enterprise vendors. If you have even one paying EU customer for a SaaS product, a plugin, a mobile app, or a device with firmware, you're in scope. There's no small- business carve-out for the reporting obligation itself, though enforcement priorities in the first year are widely expected to focus on larger or higher-risk vendors first. This is not legal advice — see the disclaimer below — but the plain text of the Regulation does not exempt small vendors from Article 14.

What triggers the clock?

Actively exploited vulnerability in your product — you become aware that a vulnerability is being exploited in the wild, not just that one exists. This is the fast, 24-hour trigger.
Severe incident having an impact on the security of your product — a broader trigger covering security incidents beyond just a known CVE.

Most small vendors will encounter the first case: a dependency they ship (a library, a framework, an OS package) gets a CVE added to a known-exploited list, and now the clock is running on their product, even though they didn't write the vulnerable code.

The three deadlines

Report	Deadline	What it contains
Early warning	24 hours from awareness	Basic facts: what's affected, that it's being exploited, cross-border relevance if known
Follow-up notification	72 hours from awareness	Updated assessment, initial indicators of compromise, corrective measures taken/planned
Final report	14 days after a fix is available	Full description, severity, impact, and remediation details

"Awareness" is the operative word for the clock start — not when the CVE was published, but when you became aware it applies to your product. That's exactly the gap a monitoring tool closes: most small vendors aren't watching CISA's or ENISA's feeds daily, so "awareness" can arrive days late purely from not checking.

What you actually have to do, in order

1. Know what you ship. A list of the key dependencies, libraries, and components in your product — even a rough one — is the prerequisite for everything else. You can't know you're affected by a KEV entry if you don't know what's in your own product.
2. Watch for exploitation, not just disclosure. New CVEs are published constantly; the Article 14 trigger is specifically active exploitation, which CISA's Known Exploited Vulnerabilities (KEV) catalog tracks for free, publicly, updated as new evidence comes in.
3. When you get a match, report to ENISA within 24 hours. The early-warning report doesn't need to be exhaustive — it needs to exist within the window with the basic facts.
4. Follow up at 72 hours and finalize at 14 days once a fix or mitigation exists.

Where the risk actually is for a small vendor

It's not the reporting itself — ENISA's forms are short. It's missing the clock entirely because nobody on a two-person team is checking a government vulnerability feed every day on top of shipping product. Penalties for non-compliance run up to €15M or 2.5% of global annual turnover, though realistically first-year enforcement focus and proportionality provisions matter — this piece isn't legal advice on your specific exposure.

A free way to check your own exposure right now

ExploitWatch checks CISA's KEV catalog against a plain-text list of your dependencies, free, with no signup. If you want it checked daily going forward — so you find out the moment something matches instead of finding out when it's already a problem — that's the $19/mo version below.

This is not legal advice. This page is a plain-language summary for orientation purposes only. Whether Article 14 applies to your specific product, what counts as "awareness" in your situation, and how to file with ENISA or your national CSIRT are legal questions that depend on your facts. Consult qualified counsel. ExploitWatch is a monitoring aid, not a compliance guarantee.