Usama · Founder
Checked against the regulation on 16 Oct 2026 · What changed
One page of terms used on the CRA side of this site. A term gets its own URL only when it needs a much longer answer.
A vulnerability for which there is reliable evidence that a malicious actor has exploited it in a product with digital elements. It is one of the two events Article 14 tells a manufacturer to report. A bug with no evidence of exploitation is not, by itself, this report.
The people who mark a case this way should write down the evidence. That note is what a later reader uses to see why the clock started.
Source: Article 3 and Article 14.
A person established in the Union who holds a written mandate from the manufacturer to carry out named tasks. The mandate can cover contact with authorities. It does not, on its own, move the decision to report away from the manufacturer.
Source: Article 3.
The moment Article 14 uses to start the 24-hour and 72-hour clocks. The deadline runs from awareness, not from the moment a fix exists and not from the moment someone has a complete analysis.
A runbook should say who is allowed to record that time, and what kind of message counts, before a real report arrives in a crowded inbox.
Source: Article 14.
The marking the manufacturer affixes after the conformity assessment, when placing the product on the market. Under the application calendar it belongs with the full set of duties from 11 December 2027. It is not a substitute for an Article 14 report, which has applied since 11 September 2026.
Source: Chapter III and Article 71.
The check that the essential cybersecurity requirements in Annex I are met, done before the manufacturer signs the EU declaration of conformity and affixes the CE marking. Many products can use the manufacturer's internal procedure. Important products of class II and critical products need a notified body, or a European cybersecurity certification scheme where that scheme is allowed.
Source: Article 32 and Annex VIII.
A product whose core function is a category listed in Annex IV. The manufacturer needs a third-party assessment, or a European cybersecurity certification scheme where the Commission has said that scheme can be used. The technical descriptions of the categories sit in a separate Commission implementing regulation.
Source: Annex IV and Article 32.
A computer security incident response team designated by a Member State. An Article 14 notification is addressed to the CSIRT of the Member State where the manufacturer has its main establishment, and to ENISA. You send it once, through the Single Reporting Platform.
Source: Article 14 and Article 16.
The CSIRT designated to receive the notification and to pass it on. It shares the notification with the CSIRTs of other Member States on whose territory the product has been made available. The manufacturer does not file a separate report in each of those countries.
Source: Article 14.
A person in the supply chain, other than the manufacturer or the importer, who makes a product with digital elements available on the Union market without changing its properties. They check the CE marking, the contact details, the user instructions and the support end date.
Source: Article 3 and Chapter II.
The first Article 14 notification. It is due within 24 hours of the manufacturer becoming aware of an actively exploited vulnerability or a severe incident. It is a short alert, including, where known, the Member States in which the product has been made available. It is not the full analysis.
Source: Article 14.
The manufacturer, the authorised representative, the importer, the distributor, or another person who has obligations for manufacturing a product with digital elements or for making it available on the market.
Source: Article 3.
The EU Agency for Cybersecurity. It runs the Single Reporting Platform used for Article 14. A notification submitted there is made available to ENISA as well as to the CSIRT that first receives it.
Source: Article 16.
The document the manufacturer draws up once the conformity assessment shows that the essential cybersecurity requirements are met. Annexes V and VI give the model, including a shorter form. The manufacturer signs it.
Source: Annexes V and VI.
The last Article 14 filing. For an actively exploited vulnerability it is due no later than 14 days after a corrective or mitigating measure is available. For a severe incident it is due within one month after the 72-hour notification. The two events do not share one final deadline.
Source: Article 14.
A European standard adopted at the Commission's request. Applying one can support a presumption that the essential cybersecurity requirements are met, and it can change which assessment path is open for an important product of class I.
Source: Chapter III.
A product whose core function is a category in Annex III. Class I can use the manufacturer's own assessment only when harmonised standards, common specifications or an applicable certification scheme are used. Otherwise a notified body assesses it. Class II needs a third-party assessment or an applicable scheme. Free and open-source software in these classes has a stated exception when the technical documentation is made public.
Source: Annex III and Article 32.
A person established in the Union who places on the market a product with digital elements that bears the name or trademark of a person established outside the Union. Before placing it on the market, the importer checks that the manufacturer has carried out the conformity assessment and drawn up the technical documentation.
Source: Article 3 and Chapter II.
Supplying a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether paid or free of charge. Article 14 reporting applies to products made available on that market, including products placed there before 11 December 2027.
Source: Article 3 and Article 14.
A person who develops or manufactures a product with digital elements, or has it developed or manufactured, and markets it under their name or trademark. Most of the duties, including Article 14 reporting, sit with the manufacturer. An importer or a distributor that sells under its own name, or that substantially changes the product, can take those duties on.
Source: Article 3 and Article 13.
The authority a Member State designates to enforce the regulation. It can ask for the technical documentation and require corrective action. It is not the address for the 24-hour early warning. That notification goes through the Single Reporting Platform.
Source: Chapter V.
Size bands in EU law. Manufacturers in these bands are not meant to be fined for missing only the 24-hour early-warning deadline. The duty to send the early warning still applies, and the later notifications are unchanged.
Source: Article 64, as summarised by the Commission.
A conformity assessment body that a Member State has notified under Chapter IV. Those notification rules have applied since 11 June 2026. A notified body assesses whether certain products meet the essential requirements. It does not file an Article 14 report for the manufacturer.
Source: Articles 35 to 51 and Article 43.
The fuller Article 14 notification, due within 72 hours of becoming aware, unless that information was already provided. It includes general information about the product, the general nature of the exploit or incident, corrective or mitigating measures taken, measures users can take, and how sensitive the manufacturer considers the information to be.
Source: Article 14.
A legal person, other than a manufacturer, whose purpose is to support specific free and open-source software on a sustained basis, where that software is intended for commercial activities, and who keeps that software viable. Article 24 gives stewards a cybersecurity policy, cooperation with authorities, and a narrower reporting duty.
The Commission states that stewards' reporting under Article 24(3) applies from 11 December 2027, not from 11 September 2026. Stewards are not subject to the regulation's penalties.
Source: Article 3 and Article 24.
The first making available of a product with digital elements on the Union market. A product placed before 11 December 2027 meets the full requirements only if it is substantially modified after that date. Article 14 reporting applies to it anyway, once the product has been made available.
Source: Article 3 and Chapter VIII.
A software or hardware product and its remote data processing, including a component placed on the market separately. The regulation covers such a product when it is made available on the Union market and its purpose, or a reasonably foreseeable use, includes a data connection to a device or network.
Source: Article 3.
Processing done at a distance for software the manufacturer designed, or had designed, where the product cannot perform one of its functions without it. A cloud back end the product needs in order to work is in that definition. A pure SaaS service that is not such a back end generally is not.
Source: Article 3.
A software bill of materials: a machine-readable inventory of the components in a product. Annex I asks for one covering at least the top-level dependencies, kept with the technical documentation and available to authorities on request. The regulation does not name a single file format.
Source: Annex I.
An incident that has an impact on the security of the product with digital elements. It is the other Article 14 report. It uses the same 24-hour early warning and 72-hour notification as an actively exploited vulnerability, and a different final report: within one month of that 72-hour notification.
Source: Article 3 and Article 14.
The platform ENISA operates under Article 16. Manufacturers submit an Article 14 notification there once. The platform has been operational since 11 September 2026. The notification is addressed to the CSIRT of the manufacturer's main establishment and is made available to ENISA.
Source: Article 16.
A change that brings a product already placed on the market before 11 December 2027 under the full requirements. Reporting under Article 14 does not wait for that change. Products already made available are in the reporting duty.
Source: Article 3 and Chapter VIII.
The period the manufacturer sets, during which vulnerabilities of the product are handled as Annex I requires. The end date, including the month and the year, has to be clear at the time of purchase. It is a vulnerability-handling period. It is not the switch that turns Article 14 on or off.
Source: Article 13 and Annex II.
The file the manufacturer draws up before placing the product on the market and keeps for the market surveillance authorities. Annex VII lists the minimum contents. The SBOM is part of that file.
Source: Annex VII.
The Annex I duties that apply for the support period: a contact point, a decision on the record, and a fix provided without delay when a fix is the decision you took. When a case is an actively exploited vulnerability, it also moves onto the Article 14 clocks.
Source: Annex I, Part II.
Founder of Samisoftz. He writes these pages and builds the software. About Usama
You'll talk to Usama, who'd build it.
30 minutes · no slides · a written answer if it's not a fit
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.
