European UnionCyber Resilience Act, Manufacturer Reporting Obligations
Regulation (EU) 2024/2847, Art. 14
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- The reporting obligations of Article 14 apply to a product with digital elements from .
- Notify the computer security incident response team (CSIRT) designated as coordinator for your main establishment and ENISA, through the single reporting platform, of any actively exploited vulnerability you become aware of in your product: an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure becomes available, the notification and the final report each unless the relevant information has already been provided.
- Notify the same recipients of any severe incident affecting the security of your product on the same 24-hour early warning and 72-hour incident notification clock, followed by a final report within one month of the incident notification; the incident notification and the final report each apply unless the relevant information has already been provided. For either an exploited vulnerability or a severe incident, give the CSIRT an intermediate report on relevant status updates if it asks for one.
- After becoming aware of the vulnerability or incident, inform the affected users, and where appropriate all users, of it and of any risk mitigation or corrective measures they can take.
- Apply this to every product with digital elements within the Regulation's scope that you have on the EU market, including one placed there before , because Article 69(3) exempts Article 14 from the transitional rule that spares existing products until they are substantially modified. Article 2 leaves out, among others, products covered by Regulations (EU) 2017/745, (EU) 2017/746 and (EU) 2019/2144, products certified under Regulation (EU) 2018/1139, equipment within Directive 2014/90/EU, spare parts that replace identical components, and products developed or modified exclusively for national security or defence purposes.
These lines are LexLint's reading of the law's text. Also read by: European Commission, Directorate-General for Communications Networks, Content and Technology (DG CONNECT) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 64(2): non-compliance with the obligations set out in Articles 13 and 14 (together with the essential cybersecurity requirements of Annex I) carries a higher tier of up to EUR 15,000,000 or 2.5 percent of worldwide annual turnover, whichever is higher. Article 64(10)(a) exempts manufacturers qualifying as microenterprises or small enterprises from the administrative fine for missing the Article 14(2)(a) or 14(4)(a) 24-hour early-warning deadline specifically, and Article 64(10)(b) exempts open-source software stewards from administrative fines for any infringement of the Regulation.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 2.5
Who enforces it
Enforcement body
The market surveillance authority designated by each EU Member State under Article 52 of the Regulation, working with the CSIRT designated as coordinator and ENISA under the single reporting platform established by Article 16.
Enforcement record
The Regulation's own applicability provision, Article 71(2), states that the reporting obligations of Article 14 apply from , ahead of the Regulation's general application date of . Before no manufacturer was subject to the Article 14 duty, so no market surveillance authority could have taken an enforcement action under it in the period leading up to that date. The applicability article itself puts the number of enforcement actions before at zero; the duty has applied for under a week as of the date above, too briefly for a register of enforcement action under it to exist yet.
- As of
- Source link
- https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng
Settledness
- As of
- Guidance link
- https://digital-strategy.ec.europa.eu/en/policies/cra-reporting
- Guidance body
- European Commission, Directorate-General for Communications Networks, Content and Technology (DG CONNECT)
- Open questions
- When does a manufacturer become "aware" of an actively exploited vulnerability or severe incident for the purpose of starting the 24-hour early warning clock: on the first internal report reaching any employee, or only once a function within the manufacturer responsible for cybersecurity has confirmed it?
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r2847
What this law does
Article 14 requires a manufacturer to notify any actively exploited vulnerability or severe incident affecting a product with digital elements to the computer security incident response team (CSIRT) designated as coordinator for its main establishment and simultaneously to ENISA, through the single reporting platform established under Article 16.
For a vulnerability, the manufacturer submits an early warning within 24 hours of becoming aware, a fuller vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure becomes available, the notification and the final report each unless the relevant information has already been provided.
For a severe incident, the same 24-hour early warning and 72-hour incident notification apply, followed by a final report within one month of the incident notification, with the same exception for information already provided; for either, the CSIRT designated as coordinator may ask for an intermediate report on relevant status updates.
After becoming aware of either, the manufacturer must inform the affected users of the product, and where appropriate all users, of the vulnerability or incident and of any risk mitigation or corrective measures they can take.
Under Article 16(2), in exceptional circumstances, in particular on the manufacturer's request and in light of the sensitivity of the notified information that the manufacturer indicates, the CSIRT designated as coordinator that receives a notification may delay its onward dissemination via the single reporting platform to the CSIRTs of the Member States where the product has been made available, on justified cybersecurity-related grounds and for a period that is strictly necessary, including where a vulnerability is subject to a coordinated vulnerability disclosure procedure under Article 12(1) of Directive (EU) 2022/2555.
The delay concerns only that onward dissemination, and the manufacturer's early warning of an actively exploited vulnerability is still due within 24 hours of the manufacturer becoming aware of it.
Commission Delegated Regulation (EU) 2026/881 specifies the terms and conditions under which the CSIRT initially receiving a notification may delay its dissemination to the relevant CSIRTs, for a period limited to what is strictly necessary, where in light of the sensitivity of the notified information the cybersecurity risks of disseminating it outweigh the security benefits and handling restrictions cannot mitigate them, and at least one listed condition is met, such as an effective risk mitigation measure expected within 72 hours.
The same Delegated Regulation sets separate conditions for delaying dissemination to a specific relevant CSIRT, and enters into force on the twentieth day following its publication in the Official Journal. Article 65 makes Directive (EU) 2020/1828 on representative actions apply to an infringement of this Regulation that harms, or may harm, the collective interests of consumers.
Under that Directive a qualified entity, meaning an organisation or public body representing consumers' interests, brings the action as claimant on consumers' behalf.
When LexLint raises it
When your app profile says your app distributes a software product or ships a mobile app.
Back to the example · Lint your app
Page updated .