Article 14 Reporting Pack
Be ready to report within 24 hours. Starting today.
Since 11 September 2026, every manufacturer must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform. The obligation also covers products sold years ago.
Aware
The clock starts
24 hours
Early warning
72 hours
Notification
Final report
14 days after a fix is available (vulnerability) · 1 month after the notification (severe incident)
Article 14 of Regulation (EU) 2024/2847. Reports go through ENISA's Single Reporting Platform.
In the pack
Reporting playbook
Triggers, deadlines, roles, a decision tree, the coordinating CSIRT and what to tell users.
Notification templates
Early warning, notification, intermediate and final reports, and the user advisory, ready to fill in.
Case file and exercise record
A record for every case, and six tabletop scenarios to rehearse before a real one.
Why it matters
The platform's own countdown does not match the legal deadlines. The playbook shows you how to run your own clock from the moment you become aware.