CRA Article 14 for SMEs and microenterprises: same clocks, narrow relief

Article 14 does not ask how big you are

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. That duty has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)).

Nothing in Article 14(1)–(8) scales the clocks by headcount or turnover. If you are the manufacturer of an in-scope product and awareness hits, the same chain runs whether you are a five-person start-up or a listed group. Clock detail lives in the reporting deadlines and becoming-aware guides.

What Article 64(10) actually carves out

Article 64(10)(a) is the line teams misread as “SMEs need not report.” It exempts manufacturers that qualify as microenterprises or small enterprises from the administrative fines that would otherwise attach to failing the early-warning deadlines in Article 14(2)(a) and Article 14(4)(a) — the two 24-hour limbs. It does not:

• cancel the obligation to submit those early warnings;
• cover the 72-hour vulnerability/incident notification;
• cover the final report;
• extend to medium-sized enterprises.

Full penalty tiers and the open-source steward carve-out sit on the fines for missed deadlines page. Article 64(5)(c) still tells authorities to weigh size (including start-ups) when setting a fine amount for other breaches — that is sentencing guidance, not a reporting waiver.

Helpdesks and Art 33: support around the duty, not instead of it

Article 17(6) is explicit: CSIRTs designated as coordinators shall provide helpdesk support in relation to the reporting obligations pursuant to Article 14 to manufacturers and in particular manufacturers that qualify as microenterprises or as small or medium-sized enterprises. Use that channel when you are stuck on CSIRT choice, SRP fields or how to describe an early warning — then still file on time.

Article 33 piles on Member State awareness and training, dedicated communication channels, testing support, optional regulatory sandboxes, Commission SME guidance and advertising of Union financial support. Article 33(5)'s simplified form is for Annex VII technical documentation in conformity assessment — not for Article 14 SRP notifications. Article 14(10) only lets the Commission specify notification formats and procedures by implementing act; it is not a standing SME format exemption.

The trap: “we’re small, so SRP can wait”

Two failure modes show up in triage. First: treating the 24-hour fine carve-out as permission to skip the early warning, then discovering the 72-hour and final-report clocks still run at full exposure. Second: waiting for Art 33 guidance, a sandbox, or a “simplified SRP form” that does not exist for reporting. If the mandatory tests are met, run Article 14 now; use the CSIRT helpdesk in parallel.

Neighbouring traps that are not size-based: open-source stewards (later calendar), importers and distributors (usually not the Art 14 filer), and non-EU manufacturers (still manufacturer-duty, no EU-seat limb).

Questions people ask

Do microenterprises and SMEs have to file Article 14 reports?

Yes when you are the manufacturer of an in-scope product with digital elements and you become aware of an actively exploited vulnerability or a severe incident impacting that product’s security. Article 14 has no size limb. The 24-hour early warning, 72-hour notification and final report run through ENISA’s Single Reporting Platform from 11 September 2026 (Article 71(2)), including for products already on the market (Article 69(3)).

Does the micro/small fine carve-out mean we can skip the 24-hour early warning?

No. Article 64(10)(a) exempts microenterprises and small enterprises from administrative fines for missing the early-warning deadlines in Article 14(2)(a) and 14(4)(a) only. It does not remove the duty to submit those early warnings, and it does not cover the 72-hour notification or the final report. Medium-sized enterprises are outside that carve-out entirely.

Is Article 14(10) a simplified reporting format for SMEs?

No. Article 14(10) only empowers the Commission to adopt implementing acts on notification formats and procedures for Articles 14, 15 and 16 — it is not an SME reporting holiday. The simplified technical-documentation form in Article 33(5) targets Annex VII for conformity assessment, not Single Reporting Platform filings.

What help does the CRA actually give smaller manufacturers on reporting?

Article 17(6) requires CSIRTs designated as coordinators to provide helpdesk support on Article 14 reporting, in particular to microenterprises and to small and medium-sized enterprises. Article 33 adds national awareness, channels, sandboxes and Commission guidance focused on SME implementation. None of those measures stops the Article 14 clock once awareness hits.

We’re a start-up — are the clocks softer?

Not by calendar. Article 64(5)(c) tells authorities to weigh size (including start-ups) when setting a fine amount — but Article 14 still uses the same 24-hour / 72-hour / final triggers for every in-scope manufacturer. Treat size as a factor in penalty quantum, not as a licence to skip SRP.

How is this different from open-source software stewards?

Stewards under Article 3(14) / 24(3) face a later, scoped reporting calendar from 11 December 2027, plus a broader Article 64 fine carve-out. A commercial manufacturer that places FOSS-based products on the market under its name is still on the live Article 14 manufacturer track from 11 September 2026. See our open-source stewards guide for that split.