CRA's 24-hour rule for exploited vulnerabilities: what the new ENISA guidance says

When the clock starts

The CRA's 24-hour reporting duty works like when you lose your bank card: the clock starts when you notice it, not when someone else does. The question is what 'particularly exceptional circumstances' means, and ENISA's new guidance gives the first official answer ^[1].

The Cyber Resilience Act has applied since 11 September 2026, and it requires manufacturers to report actively exploited vulnerabilities and serious incidents through ENISA's Single Reporting Platform ^[2]. If an exploited vulnerability meets the 'particularly exceptional circumstances' threshold, the manufacturer must send an early warning within 24 hours. For other cases, the manufacturer has 72 hours to submit an initial notification and 14 days for a final report ^[2].

ENISA published its guidance on PEC on 3 April 2025 to help manufacturers decide when the 24-hour rule applies ^[1].

The three criteria

The guidance defines three criteria that together indicate particularly exceptional circumstances ^[1]:

1. Widespread exploitation: the vulnerability is being exploited at scale or is likely to be, for example through automated attacks or publicly available exploit code.
2. Significant impact: the exploitation has or is likely to have a significant impact on users, critical infrastructure or the supply chain.
3. Lack of effective mitigation: no effective workaround or patch is available at the time of reporting.

All three must be met for the 24-hour duty to apply ^[1]. If only one or two criteria are met, the manufacturer follows the standard 72-hour timeline for an initial notification.

The guidance gives examples of each criterion. Widespread exploitation includes cases where exploit code has been published, where attacks are automated or where exploitation is observed across multiple sectors or regions ^[1]. Significant impact covers threats to critical infrastructure, large-scale data breaches, disruption of essential services and threats to health or safety ^[1]. Lack of effective mitigation means there is no workaround that users can reasonably apply, and no patch that addresses the root cause ^[1].

When you knew

The 24-hour clock starts when the manufacturer becomes aware that the exploited vulnerability meets all three PEC criteria, not when the vulnerability itself is first discovered ^[1]. That distinction matters. A manufacturer may know about a vulnerability for weeks, working on a patch, and then learn that it is being exploited at scale. The 24-hour duty begins at that point.

The guidance says manufacturers should have processes in place to monitor threat intelligence, customer reports and public sources so they can detect PEC situations early ^[1]. It also notes that manufacturers should keep records of when they became aware of each criterion, since supervisors may ask ^[1].

What the early warning must contain

An early warning under PEC is shorter than a full initial notification. It must include ^[1]:

• a description of the vulnerability and how it is being exploited,
• the affected products,
• the number and type of users or systems affected or likely to be affected,
• any available mitigation measures,
• the expected timeline for a patch or further information.

The early warning does not need to include a full technical analysis or a final impact assessment ^[1]. The manufacturer submits the full initial notification within 72 hours and the final report within 14 days, both through the Single Reporting Platform ^[2].

What this means for you

If your products fall under the CRA, the PEC guidance is worth reading in full before an incident puts you on the clock. Here are three questions to ask now:

• Do we monitor the right sources to know when a vulnerability is being exploited, and at what scale?
• Who decides whether the three PEC criteria are met, and how quickly can they decide?
• Can we show when we became aware of each PEC criterion, if a supervisor asks a year later?

The last question is the evidence question. Reporting timelines are counted from the moment of awareness, and memory fades. A sealed record of when the security team first saw the threat intelligence report, or when the decision to escalate was made, is a short answer to a question that otherwise takes a long one.

How a digital witness fits here

Here, the thing to seal is each step of the incident as it happens: the first detection note, the decision that PEC criteria are met, and the early warning as it is sent to the platform ^[3]. Each step gets a fingerprint and a timestamp, sealed through WitniumChain's REST API, SDK or MCP server. The records themselves stay in your systems. The sealed fingerprints go on a chain where any later change would show, even one made by us.

Say a supervisor asks why the early warning went out after 30 hours instead of 24. With a sealed timeline, you can show when the security team first saw the exploit code, when the legal team confirmed significant impact, and when the early warning was filed. If the records match their sealed fingerprints, nobody can claim they were written after the fact.

What a digital witness doesn't do is decide whether you were actually aware, whether the criteria were met or whether the report was adequate. It shows when each step was recorded, in a way nobody can quietly rewrite afterwards.

The first 2,000 witnesses a month are free. The content never leaves your systems, only the fingerprint does. Anyone you share a record with can check that it hasn't changed by comparing the fingerprint. Read the documentation or get access now.

What to watch

The CRA's manufacturer obligations have applied since 11 September 2026 ^[2]. ENISA's Single Reporting Platform is live, and the PEC guidance is the first detailed interpretation of the 24-hour rule. Expect supervisors to refer to it when they review reporting timelines.

For products placed on the market after 11 December 2027, additional technical requirements apply, including security by design and vulnerability handling ^[2]. The conformity assessment deadlines are later, but the reporting duties are already here.