CRA Article 14 deadline calculator
Article 14: 24 hours for the early warning, 72 hours for the notification. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents to their coordinating CSIRT and ENISA. Enter the moment you became aware, and you get every deadline in your own time zone.
| Report | Due by | Basis |
|---|---|---|
| Early warning | — | Art. 14(2)(a) and 14(4)(a) |
| Notification | — | Art. 14(2)(b) and 14(4)(b) |
| Final report | — | Art. 14(2)(c): 14 days after a fix is availableArt. 14(4)(c): one month after the notification (here: after a notification sent on its deadline) |
What each report contains
- Early warning (24 hours). That the vulnerability is actively exploited or that the incident happened, and, where known, the Member States where the product is made available. For an incident, whether it looks like an unlawful or malicious act.
- Notification (72 hours). General information about the product, the nature of the exploit or incident, the corrective or mitigating measures taken and those users can take, and how sensitive the information is.
- Final report. A description of the vulnerability or incident and its severity and impact, information on any malicious actor where available, and details of the security update or other measures.
You also inform the affected users, and where needed all users, about the vulnerability or incident and the measures they can take (Art. 14(8)). The reports go to the single reporting platform run by ENISA.
How the clock starts
Every deadline runs from the moment you become aware: not from the moment the fix is ready, and not from the next working day. Write that moment down when it happens, with the evidence that made you aware. It is the first thing an authority will ask about.
This page helps you plan and document; it is not legal advice. Check the official text and your authority’s guidance. Source: Regulation (EU) 2024/2847, Article 14. Related: how to report an actively exploited vulnerability and the CRA timeline.