The CRA's 24-hour clock started in September, and most manufacturers are still learning the rules

When the clock starts

The 24 hours in Article 14 work like losing your bank card: the clock starts when you notice it's gone, not when it suits you to call the bank. For manufacturers of products with digital elements, the timer starts the moment they become aware that a vulnerability in one of their products is being actively exploited, or that a serious incident has occurred.

The reporting obligation came into force on 11 September 2026, over a year before the rest of the CRA's requirements ^[1]. That means manufacturers have been on the clock since September, even if their products don't yet need to meet the full technical requirements.

What counts as actively exploited

A vulnerability is actively exploited when there's credible evidence that someone is using it to attack systems in the wild. That includes vulnerabilities the manufacturer discovers itself, ones reported by researchers, and ones that show up in threat intelligence feeds ^[2].

Serious incidents are events that have actually caused significant operational disruption, financial loss, physical harm or a threat to public safety. The definition is broad enough to catch incidents that affect the product's availability, authenticity, integrity or confidentiality, if the impact is serious ^[1].

The tricky part is the word "aware". Manufacturers can't wait until they've completed a full investigation. The first report, called an early warning, is due within 24 hours of becoming aware of the exploitation, even if the details are still sketchy. A more detailed report follows within 72 hours, and a final one when the incident is resolved or the vulnerability is addressed ^[1].

What goes in the report

The early warning must include a description of the vulnerability or incident, any malicious activity observed, the severity and potential impact, and what the manufacturer is doing about it ^[1]. The platform asks for technical details, timelines and affected product versions.

ENISA's common platform, which went live ahead of the September deadline, connects to national Computer Security Incident Response Teams (CSIRTs) and sectoral agencies. That means one report reaches multiple authorities, but it also means multiple authorities can see it ^[2].

What this means for you

If you make connected hardware or software (other than medical devices or type-approved vehicles), ask yourself:

• Do we have a process for becoming aware of active exploitation, including monitoring threat feeds and handling researcher reports?
• Can we draft and send an early warning within 24 hours of awareness, at any time of day?
• Who in the organisation can access ENISA's platform, and have they tested it?
• Do we log when we first became aware of an incident, so we can later show the 24-hour clock was met?

The rest of the CRA's requirements, including technical documentation, risk assessments and the CE mark, apply from 11 December 2027 ^[1]. But the reporting duty is already running.

The record of when you knew

Here, the thing to seal is the first detection note, the decision to escalate, and each report as it is sent. Sealing takes a fingerprint, not the data itself, so the content of a vulnerability report never leaves your systems. If a supervisor later asks why the early warning went out after 30 hours instead of 24, anyone you share the record with can check that the timestamped note of first awareness is the one written on the day, unchanged since.

Your system sends the fingerprint to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back. To check, calculate the fingerprint again and compare it with the sealed one. Supervisors, auditors and insurers can verify it. The first 2,000 witnesses a month are free. Read the docs.

What it shows: when each step was recorded, in a way nobody can quietly rewrite afterwards. What it doesn't show: that the report was complete, accurate or that the response was adequate.

What to watch

• 11 December 2027: the rest of the CRA's requirements apply, including technical documentation, conformity assessment and the CE mark for products with digital elements.
• 11 September 2028: two years after the reporting duty came in, expect the first public enforcement cases and guidance on what "becoming aware" means in practice.