Three dates, a single article brought forward

The existing installed base only enters the full regime in the event of a « modification substantielle » (substantial modification) from 11 December 2027 (Article 69(2); Article 3, point (30)). Until then, only notification concerns it. The printed Official Journal of 20 November 2024 omits the word « avant » (before) in Article 69(3); the corrigendum of 2 July 2025 [1] restores it, and it is the corrigendum that is authoritative. The Commission services' FAQ, entry 5.3 [2], points the same way, without binding force.

Am I concerned? Three questions

1. Who markets the product under its name or trademark? The manufacturer is the one who develops, manufactures or « fait concevoir, développer ou fabriquer » a product and markets it under its name or trademark, « à titre onéreux, monétisé ou gratuit » (Article 3, point (13)). A publisher that assembles no physical object is a manufacturer. A subsidiary that affixes its own trademark, including as a white label, to a product developed elsewhere in the group becomes a manufacturer. The authorised representative, the importer and the distributor do not become bound under Article 14.
2. Is an artefact delivered to the customer? Software alone is a product (Article 3, points (1) and (4)), as is the component placed on the market separately: library, development kit, module, driver, connector (point (6)). An agent, a mobile application, an extension or a connector that is delivered brings into scope the hosted service on which one of its functions depends (point (2); recital 11). A service accessible only through a browser, with no artefact delivered at all, is qualified by no provision of the text.
3. Where are the products' cybersecurity decisions taken? This question does not change who notifies; it designates the recipient. The competent CSIRT is that of the Member State where those decisions are mainly taken, failing which that of the establishment with the largest number of employees in the Union (Article 14(7), second subparagraph). A manufacturer with no main establishment in the Union follows a mandatory cascade: authorised representative, importer, distributor, then users (third subparagraph).

Two cases read separately. The manufacturer that integrates a free and open-source component remains the manufacturer of its product, with all its obligations. The open-source software steward (Article 3, point (14)) is bound to part of Article 14 only through Article 24(3), which Article 71(2) does not bring forward: its obligation arises on 11 December 2027 (a reading corroborated by the FAQ, entry 5.5 [2]). In the meantime, the same incident can bind the integrating manufacturer and leave the steward outside the mechanism.

What triggers a notification, and what does not

Actively exploited vulnerability

Only the third degree of Article 3 triggers Article 14(1): a vulnerability « pour laquelle il existe des preuves fiables qu'elle a été exploitée par un acteur malveillant dans un système sans l'autorisation du propriétaire du système » (point (42)). Three cumulative elements: reliable evidence, a malicious actor, an absence of authorisation. An exploitable vulnerability (point (41)), or a flaw demonstrated in a laboratory, is not enough. The text does not say what makes evidence « fiable » (reliable).

Severe incident

Article 3 does not define « incident grave » (severe incident having an impact on security). The test is in Article 14(5): the incident affects, or may affect, the protection of data or functions that are « sensibles ou importantes » (sensitive or important) (a), or it has led, or may lead, to the introduction or execution of malicious code in the product or in a user's systems (b). One limb is enough. The qualifier « sensibles ou importantes » (sensitive or important) is defined nowhere.

Third-party components

Article 14 contains no rule specific to integrated components: the test of point (42) applies to the product as delivered, whatever the origin of the code. The FAQ, entry 5.4 [2], writes that a component vulnerability that is not exploitable in the product is not to be notified. That reading is consistent with point (42), but a services document founds no exclusion.

What remains optional

Article 15 opens voluntary reporting for four categories: the vulnerability without evidence of exploitation, the cyber threat affecting the product's risk profile, the incident that does not meet the test of paragraph 5, and the near miss. The verb is « peuvent notifier » (may notify), and a single recipient is enough: the CSIRT « ou » (or) ENISA. Voluntary reporting imposes no additional obligation on its author (Article 15(5)).

To whom, and through what

• Two recipients, simultaneously: the CSIRT designated as coordinator and ENISA (Article 14(1) and (3)). That CSIRT is the one the Member State designated under the NIS2 Directive (Article 3, point (51)); the regulation creates no new authority.
• A single channel: the single reporting platform, established and maintained by ENISA (Article 16(1)). The manufacturer files once, at the electronic notification end-point of its CSIRT, and the platform makes the notification available to ENISA (Article 14(7), first subparagraph). The receiving CSIRT then disseminates it to the CSIRTs of the Member States where the product has been made available (Article 16(2)).
• A group example: product cybersecurity decisions taken in Paris, sales in Belgium through a distribution subsidiary. The end-point is that of the French CSIRT; the Belgian CSIRT is informed through the dissemination of Article 16(2).
• The format: the Commission « peut » (may) specify it by implementing acts (Article 14(10)). That is a power without a time limit: the obligation to notify does not depend on it.
• Belgium: ENISA's list [4], updated on 4 September 2026, carries for Belgium only a URL in the ccb.belgium.be domain, with no entity name. That the Centre for Cybersecurity Belgium is the coordinating CSIRT under the CRA is an inference, not the reading of a Belgian act. Its general contact page [5] is not the Article 14 channel.
• NIS2: no line of Articles 14 to 16 exempts a manufacturer that is also a NIS2 entity from either of the two notifications, nor organises their coordination. The CCB presents the two regimes as complementary [6] and describes a separate form for NIS2 [7]. The same event can fall under both.

The time limits: three steps, two clocks

• The starting point is the manufacturer's awareness, not discovery by a third party, the publication of a CVE or the release of a patch. The 24-hour and 72-hour time limits start from the same instant: the notification is due 72 hours after awareness, not 72 hours after the early warning. The text does not define the moment of « connaissance » (awareness).
• The final report follows two clocks. On the vulnerability side, the 14 days run only from a measure being made available, and the text provides for nothing if no measure ever is. On the incident side, the month runs from an act dated by the manufacturer itself.
• The 24-hour early warning is always due. The reservation « à moins que les informations pertinentes n'aient déjà été communiquées » opens steps b) and c), never step a). The text does not say who judges that the information was « pertinentes » (relevant).
• The intermediate report is due only at the CSIRT's request, « si nécessaire » (if necessary), with no fixed time limit (paragraph 6).
• Informing is not notifying. The manufacturer also informs the affected users and, where appropriate, all users, with the measures they can take, « en temps utile » (in a timely manner): no numbered time limit. Failing that, the CSIRT « peut » (may) inform them itself (paragraph 8).

What must be in place

The text imposes results; for none of them does it prescribe the means.

1. Qualification: which entity in the group markets which product under its name or trademark.
2. The inventory of products, of their components and of the hosted services on which a function depends, including old products still in circulation.
3. The recipient CSIRT: the place where product cybersecurity decisions are taken, the headcount per establishment, and, outside the Union, the authorised representative, the importer, the distributor and the distribution of users.
4. Access to the electronic notification end-point of the single reporting platform.
5. Internal detection: the timestamp of becoming aware and the elements that qualify a vulnerability (evidence of exploitation) or an incident (limb a or b of paragraph 5).
6. The content of the three steps, track by track, with the date a measure is made available and the date of the 72-hour notification, which start the clocks of the final report.
7. The response to a request for an intermediate report.
8. Informing users: the list of affected users and the measures available to them.

Nothing else was required on 11 September 2026: no CE marking, no technical documentation, no conformity assessment, no Annex I requirement, no Belgian market surveillance authority under the CRA. Voluntary reporting under Article 15 remains optional.

Penalties

The regulation sets ceilings and leaves the regime to the Member States (Article 64(1)). Article 14 falls under the highest tier: up to EUR 15 000 000 or, for an undertaking, a percentage of its total worldwide annual turnover, whichever is higher (Article 64(2)). That is a ceiling, not an amount due; it is set case by case, the operator's size included (paragraph 5). Microenterprises and small enterprises escape the fine for failing to meet the 24-hour time limit alone, and for nothing else: not the 72 hours, not the final report, and not medium-sized enterprises (Article 64(10)(a), corrected version [1]). As at 8 September 2026, no Belgian instrument designating an authority or providing for penalties had been identified.