Short answer: if your app has a vulnerability that attackers are actually exploiting, the manufacturer has 24 hours to send an early warning to ENISA's Single Reporting Platform.

Two things must be reported: actively exploited vulnerabilities and severe incidents that affect the security of the app (Article 14(1) and (3)).

Each one has three steps: an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days of a fix (vulnerabilities) or one month after the notification (incidents).

The clock starts when you "become aware": when an initial assessment shows with reasonable certainty that your product is being exploited, not when a CVE is published.

This has applied since 11 September 2026, including to apps that were already on the market.

What must be reported

Article 14 of the Cyber Resilience Act (CRA), Regulation (EU) 2024/2847 , sets two separate reporting duties for manufacturers:

Actively exploited vulnerabilities contained in the product (Article…