Article 14 deadlines
Article 14 clocks are not the same job as an ENISA draft pack or an open-gap checklist
Direct answer. Article 14 applies from 11 September 2026: for actively exploited vulnerabilities and severe incidents, manufacturers submit an early warning within 24 hours of becoming aware, a notification within 72 hours of becoming aware, and a final report no later than 14 days after a corrective or mitigating measure is available (vulnerabilities) or within one month after submission of the incident notification (severe incidents). CRALedger tracks Article 14 incident deadlines on the product duty file with product roles, checklists and open record gaps, encrypted ENISA SRP draft packs, vulnerability forwarding, and audit records; it does not file notifications on ENISA’s platform.
CRALedger Duty Records (Shopify App Store) tracks product roles, checklists and open record gaps, Article 14 incident deadlines, encrypted ENISA SRP draft packs, vulnerability forwarding, and audit records. It does not file notifications on ENISA’s platform. This page is the Article 14 deadline slice — not open-gap checklists or ENISA packs. This page is not legal advice.
Related: EUDR Records Manager — DDS reference numbers on supplier lots.
Free check first: CRA role and scope self-check runs in your browser and sends nothing. Describe a product and your role and see which articles of Regulation (EU) 2024/2847 to read.
Article 14 clocks (Regulation (EU) 2024/2847)
Art. 14 requires manufacturers to notify actively exploited vulnerabilities and severe incidents to the coordinating CSIRT and ENISA via the single reporting platform. The clocks in the text are:
- Early warning: without undue delay and in any event within 24 hours of becoming aware (Art. 14(2)(a); Art. 14(4)(a)).
- Notification: without undue delay and in any event within 72 hours of becoming aware (Art. 14(2)(b); Art. 14(4)(b)).
- Final report: no later than 14 days after a corrective or mitigating measure is available, for an actively exploited vulnerability (Art. 14(2)(c)); within one month after submission of the incident notification, for a severe incident (Art. 14(4)(c)).
Article 14 applies from 11 September 2026 (Art. 71). Source: Regulation (EU) 2024/2847 on EUR-Lex. This page is not legal advice.
Clocks vs packs vs gaps
Open record gaps ask what is missing before an incident. Encrypted ENISA SRP draft packs prepare a filing. Article 14 deadlines answer when the clock runs after an incident is in play.
How to track Article 14 incident deadlines
- Open the product duty file in CRALedger.
- Record the Article 14 incident deadline fields the checklist expects.
- Keep role checklists and open gaps current so the clock is not running on an empty file.
- Use ENISA draft packs when you are preparing a filing — the deadline tracker does not submit to ENISA.
Not the same as open gaps, ENISA packs, support period, or vulnerability forwarding
- Open record gaps — role checklists and open gaps.
- ENISA SRP drafts — encrypted ENISA SRP draft packs.
- Support period — support period on the product page.
- Vulnerability forwarding — importer/distributor forwarding.
What this page is not
- Not legal advice, and not an ENISA filing service.
- Not a substitute for the open-gap, ENISA, support-period, or forwarding siblings.
Related pages
- CRA duty records before an Article 14 incident
- Open CRA record gaps and role checklists
- Encrypted ENISA SRP draft packs
- CRALedger Duty Records
Describe your product and role in the free CRA role and scope self-check to see which articles to read.
Not legal advice. Confirm applicable rules before you treat a product page or checkout rule as in or out of scope.