# What does the CRA require when a vulnerability is exploited?

Article 14 of the Cyber Resilience Act requires manufacturers of products with digital elements to notify actively exploited vulnerabilities in their products, and severe incidents that affect the security of those products, in several stages. For the stages, their deadlines and who receives the notifications, see Regulation (EU) 2024/2847, Article 14. These reporting duties apply from 11 September 2026. They concern manufacturers, not companies that only use the products, although a user's own incident may still have to be reported under NIS2 or the GDPR.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Incident reporting deadlines](https://netsenx.com/en/faq/reporting) · https://netsenx.com/en/faq/what-does-the-cra-require-when-a-vulnerability-is-exploited

## Read next

- https://netsenx.com/en/nis2-incident-reporting-deadlines
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [Does DORA apply to us?](https://netsenx.com/en/faq/does-dora-apply-to-us)
- [What counts as a significant incident under NIS2?](https://netsenx.com/en/faq/what-counts-as-a-significant-incident-under-nis2)
- [Is a failed or blocked attack reportable under NIS2?](https://netsenx.com/en/faq/is-a-blocked-attack-reportable-under-nis2)
- [How can a small team meet the NIS2 24-hour early-warning deadline?](https://netsenx.com/en/faq/how-can-a-small-team-meet-the-nis2-24-hour-deadline)
- [What should we have ready before the NIS2 24-hour deadline arrives?](https://netsenx.com/en/faq/what-should-we-have-ready-before-the-nis2-24-hour-deadline)