What the text says
After becoming aware of an actively exploited vulnerability or a severe incident having an impact on the security of the product with digital elements, the manufacturer shall inform the impacted users of the product with digital elements, and where appropriate all users, of that vulnerability or incident and, where necessary, of any risk mitigation and corrective measures that the users can deploy to mitigate the impact of that vulnerability or incident, where appropriate in a structured, machine-readable format that is easily automatically processable.
The same paragraph continues: where the manufacturer fails to inform users in a timely manner, the notified CSIRTs designated as coordinators may provide that information to users when they consider it proportionate and necessary to prevent or mitigate the impact.
Users versus authorities
| Reports to CSIRT and ENISA | Information to users | |
|---|---|---|
| Legal basis | Article 14(1) to 14(4) | Article 14(8) |
| Channel | ENISA's Single Reporting Platform | Your own: advisory page, email, in-product message, customer portal |
| Timing | 24 hours, 72 hours, then the final report | After becoming aware; in a timely manner |
| Content | Set out in Article 14(2) and 14(4) | The issue and, where necessary, measures users can take |
| Format | The platform's forms | Where appropriate, structured and machine-readable |
Both 72-hour reports already ask for the measures users can take. Draft the user notice alongside the 72-hour notification so the two say the same thing.
What to prepare before an incident
- A way to reach impacted users for each product: who holds the customer list, and whether you can tell which users run which versions.
- A public advisory location, such as a security advisories page, and a machine-readable format your customers' tools can process.
- An approval path for user notices, so wording is signed off in hours, not days.
- A template, like the one below, kept with your reporting templates. CRA Article 14 report template
- A record of who was told, when and how, in the case log. CRA Article 14 evidence log
A plain user notice you can adapt
SECURITY NOTICE: [product] [short title] Date: ____ Reference: ____ WHAT HAPPENED [Actively exploited vulnerability / security incident] affecting [product, versions]. ARE YOU AFFECTED You are affected if: [versions, configurations, regions] How to check: [steps] WHAT TO DO NOW - [update / workaround / configuration change] - [how to verify the measure worked] WHAT WE ARE DOING [fix status, expected timing, next update] CONTACT [security contact / support route]
Keep it factual and actionable. Users need to know whether they are affected and what to do; internal detail on exploitation or attackers belongs in the reports to the CSIRT, where Article 14 lets you indicate how sensitive the information is.
Questions people ask
- What does CRA Article 14(8) require?
- After becoming aware of an actively exploited vulnerability or a severe incident having an impact on the security of the product, the manufacturer must inform the impacted users, and where appropriate all users, of that vulnerability or incident and, where necessary, of any risk mitigation and corrective measures they can deploy. Where appropriate this should be in a structured, machine-readable format that is easily automatically processable.
- Is informing users the same as notifying the CSIRT and ENISA?
- No. The early warning, notification and final report go to the CSIRT designated as coordinator and ENISA through the Single Reporting Platform. Informing users is a separate duty under Article 14(8), with its own audience and its own wording.
- Is there a deadline for informing users?
- Article 14(8) sets no fixed number of hours. It says the duty applies after you become aware, and that if you fail to inform users in a timely manner, the notified CSIRTs designated as coordinators may provide the information to users themselves when they consider it proportionate and necessary.
- Do we have to tell all users or only affected ones?
- The text says impacted users, and where appropriate all users. Deciding when 'all users' is appropriate is a judgement for your case owner and legal adviser; the CRA does not define it further.
- What counts as a structured, machine-readable format?
- The CRA does not name a format. Security teams commonly publish advisories in formats such as CSAF, which customers' tools can process automatically. Check current Commission and ENISA guidance before choosing.
- Does Article 14(8) apply before the rest of the CRA?
- Yes. Article 14, including paragraph 8, has applied since 11 September 2026. Most other CRA obligations, including the Annex I duty to publicly disclose fixed vulnerabilities once a security update is available, apply from 11 December 2027.