Skip to content
CRA Reporting Desk

CRA Article 14(2)(c): when the corrective or mitigating measure starts the 14-day final

Teams often treat the Article 14 chain as three clocks from the same awareness moment — or they refuse to start a “final” until a perfect patch ships. For an actively exploited vulnerability, Article 14(2)(c) is explicit: the final report is due no later than 14 days after a corrective or mitigating measure is available. That is a different trigger from the 24-hour and 72-hour stages.

The short version

  • AEV final = measure available + 14 days: Article 14(2)(c), not awareness + 14 days.
  • Corrective or mitigating: security update or other measure that remedies / mitigates — not “patch only”.
  • No measure yet ≠ overdue final: early warning and 72-hour notification still run; the 14-day limb has not started.
  • Severe-incident final is different: Article 14(4)(c) = one month after the 72-hour incident notification.
  • Live now: Article 14 from 11 September 2026 (Article 71(2)); record both awareness and measure-available timestamps.
Track your Article 14 clockOpen the deadline calculator

What Article 14(2)(c) actually says

For an actively exploited vulnerability notified under Article 14(1), the manufacturer submits, unless the relevant information has already been provided, a final report no later than 14 days after a corrective or mitigating measure is available, including at least:

  • a description of the vulnerability, including its severity and impact;
  • where available, information concerning any malicious actor that has exploited or that is exploiting the vulnerability;
  • details about the security update or other corrective measures that have been made available to remedy the vulnerability.

That text does two jobs at once: it sets the clock (“available”) and it describes the minimum contents of the close-out filing. Official submission still goes through ENISA's Single Reporting Platform.

Two timestamps — do not collapse them

Awareness starts Article 14(2)(a) (early warning within 24 hours) and Article 14(2)(b) (vulnerability notification within 72 hours). See becoming aware and the reporting deadlines guide. Those stages do not wait for a fix — including for exploited zero-days.

Measure available starts the Article 14(2)(c) 14-day final. ENISA's platform does not know when your update or workaround shipped, so you must record that moment yourself — the free desk and deadline calculator are built around that second input. Computing “final = awareness + 14 days” invents a deadline the Regulation does not impose.

What can count as “available”

The Regulation pairs “corrective or mitigating measure” in the clock with “security update or other corrective measures … made available to remedy the vulnerability” in the contents. That framing is wider than “signed firmware dropped to every SKU.” A configuration advisory, network-level control, feature disable, or other published mitigation that users can deploy may be what makes a measure available — especially after end of support, when a full security update may never ship.

Whether a particular internal build, staged rollout, or draft advisory already counts is a counsel call on your facts. Operationally: pick a defensible “available” timestamp, write it in the evidence log, and run the 14 days from there. Do not leave the final clock unowned because the “real” patch is still in QA.

Contents vs clock — and the severe-incident contrast

Article 14(2)(c) asks you to describe the vulnerability, any known malicious actor, and the remedy that was made available. Fuller checklist wording lives on the final report and final report checklist pages. Reconcile against the early warning and 72-hour notification so facts do not contradict across the chain.

For a severe incident, Article 14(4)(c) is different: the final report is due within one month after the 72-hour incident notification, and mitigation measures appear as content (“applied and ongoing mitigation measures”), not as the trigger that starts the final clock. Do not reuse the AEV corrective-measure calendar on a severe-incident case — or the reverse. Track the case type first: AEV vs severe incident (Recital 68), then the AEV or severe incident guide.

The trap: “final waits for the perfect patch”

Two failure modes show up in triage. First: the team treats “no patch yet” as permission to skip or delay the 24-hour and 72-hour stages. Wrong — those run from awareness. Second: once a workaround or other mitigation is published, the team still refuses to start the 14-day final because a “proper” update is weeks away. If that mitigation is the measure that is available, Article 14(2)(c) may already be running. Neighbouring traps: end-of-support confusion, and inventing an awareness-based 14-day final.

Questions people ask

When does the 14-day Article 14 final-report clock start for an actively exploited vulnerability?
Article 14(2)(c) starts it when a corrective or mitigating measure is available — not when you became aware of the vulnerability. Awareness starts the 24-hour early warning and 72-hour vulnerability notification under Article 14(2)(a)–(b). The final report is a separate trigger: no later than 14 days after that measure is available, unless the relevant information has already been provided.
Does “corrective or mitigating measure” mean only a signed security update?
No. Article 14(2)(c) says “corrective or mitigating measure”, and the final-report contents ask for details about “the security update or other corrective measures that have been made available to remedy the vulnerability.” A published workaround, configuration change, network control, or other mitigation that users can deploy can be what makes a measure “available” — decide with counsel for your facts. Waiting for a perfect patch does not keep the final clock off forever once a usable mitigation is out.
If we have not shipped any fix yet, is the final report overdue?
Not under the 14-day limb. Until a corrective or mitigating measure is available, Article 14(2)(c)’s 14-day deadline has not started. The early warning and 72-hour notification still run from awareness whether or not a fix exists. Do not invent a “14 days from awareness” final deadline the Regulation does not impose — and do not skip the first two stages while waiting for a patch.
What must the Article 14(2)(c) final report contain?
At least: (i) a description of the vulnerability, including its severity and impact; (ii) where available, information concerning any malicious actor that has exploited or is exploiting the vulnerability; and (iii) details about the security update or other corrective measures that have been made available to remedy the vulnerability. The duty applies unless the relevant information has already been provided.
Is the severe-incident final report on the same corrective-measure clock?
No. Article 14(4)(c) closes the severe-incident track within one month after the 72-hour incident notification, and asks for applied and ongoing mitigation measures as content — not as the clock start. Only the actively exploited vulnerability final under Article 14(2)(c) is timed from when a corrective or mitigating measure is available.
When did this duty start to apply?
Article 14 has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)). Record both the awareness timestamp and the timestamp when the corrective or mitigating measure became available so the desk and your evidence log can compute the right finals.

Track awareness and measure-available separately

Log when you became aware and when the corrective or mitigating measure became available. The free desk and deadline calculator count the 24-hour, 72-hour and 14-day finals from the right triggers. No sign-up; data stays in your browser. Official CRA filing still goes through ENISA.

Track your Article 14 clockOpen the deadline calculator

Workflow support, not legal advice. Whether a concrete organisation is a CRA manufacturer of an in-scope product with digital elements, whether a vulnerability is actively exploited, when a corrective or mitigating measure became available, and what you submit — are determinations for qualified counsel. Claims above track Regulation (EU) 2024/2847 Article 14(2)(c) (and the surrounding Article 14(1)–(2) AEV cascade), Article 14(4)(c) for the severe-incident contrast, and Articles 69(3) and 71(2) for application timing. Confirm against the Official Journal text (CRA on EUR-Lex) and current Commission guidance before relying on this for a live case.