CRA Article 14 vs Article 15 voluntary reporting: near misses and non-AEV finds

What Article 14 requires (and what it does not)

Article 14 obliges manufacturers to notify actively exploited vulnerabilities contained in the product and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. That duty has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)).

Clock detail lives in the reporting deadlines and becoming-aware guides. The mandatory triggers are deliberately narrow: AEV notification needs reliable evidence of malicious exploitation (Article 3(42)); severe incidents need the Article 14(5) impact test. A missing patch alone is not enough — see zero-day vulnerabilities (Commission FAQ 5.2).

What Article 15 actually opens

Article 15(1) lets manufacturers and other natural or legal persons notify, on a voluntary basis, any vulnerability contained in a product with digital elements and cyber threats that could affect that product's risk profile, to a CSIRT designated as coordinator or to ENISA.

Article 15(2) covers any incident having an impact on the security of the product (not only “severe” ones) and near misses that could have resulted in such an incident. Article 3(45) defines near miss by reference to NIS2 Article 6(5) — roughly, an event that could have compromised availability, authenticity, integrity or confidentiality but was prevented or did not materialise. That is why a blocked intrusion path is not an automatic Article 14 filing.

Article 15(3) routes processing through Article 16 and expressly allows the coordinating CSIRT to prioritise mandatory notifications over voluntary ones. Article 15(4) is the manufacturer-alert rule for third-party notices of an AEV or severe incident only. Article 15(5) protects confidentiality and says voluntary reporting must not pile on extra obligations the notifier would not otherwise have had (criminal-law carve-out aside).

The calendar trap: Article 71(2)

Article 71(2) is short and easy to misread. The Regulation applies from 11 December 2027. The only early applications listed are Article 14 (from 11 September 2026) and Chapter IV on conformity-assessment bodies (Articles 35–51, from 11 June 2026). Article 15 is not carved out — so the Article 15 voluntary legal channel applies with the general date, 11 December 2027. Do not treat “voluntary CRA reporting” as a live substitute calendar for today's mandatory Article 14 chain.

Platform reality matches the caution: ENISA's SRP FAQ Q6 and Q27 say voluntary notifications under Article 15(1)/(2) are a future SRP phase. Until that lands, only mandatory AEV and severe-incident notifications can be submitted through the portal. Commission FAQ 5.2 and FAQ 5.4 still point manufacturers at Article 15 for non-mandatory finds (zero-days without exploitation evidence; component flaws not exploitable in your product) — read that as the legal category, not as proof the portal button exists today. See also third-party components.

The trap: “we’ll just voluntarily SRP it”

Two failure modes show up in triage. First: flooding the mandatory track with research finds and near misses that never met Article 3(42) or Article 14(5) — wasting the 24-hour window and muddying awareness records. Second: sitting on a real AEV or severe incident because someone labelled it “voluntary” or waited for an Article 15 portal feature. If the mandatory tests are met, run Article 14 now; if they are not, keep vulnerability handling (and, when Article 15 applies and a channel exists, consider voluntary notice) without inventing a 24-hour duty.

Other regimes still do not substitute: CRA vs GDPR, CRA vs NIS2. Open-source stewards have their own later Article 24(3) calendar — see open-source software stewards.

Questions people ask

Is every vulnerability or blocked attack an Article 14 report?

No. Article 14 binds manufacturers only for actively exploited vulnerabilities (Article 3(42)) and severe incidents having an impact on the security of the product (Article 14(5)). Near misses, unexploited findings, cyber threats and non-severe incidents sit outside that mandatory chain. Those categories are what Article 15 opens on a voluntary basis — they do not start a 24-hour early warning by themselves.

What can you notify under Article 15 that Article 14 does not require?

Article 15(1): any vulnerability in a product with digital elements, and cyber threats that could affect that product’s risk profile. Article 15(2): any incident having an impact on the product’s security (not only severe ones), and near misses that could have resulted in such an incident. Manufacturers and other natural or legal persons may notify a CSIRT designated as coordinator or ENISA. Article 3(45) points “near miss” at NIS2 Directive (EU) 2022/2555 Article 6(5).

When does Article 15 apply — is voluntary reporting live with Article 14?

Not under the same calendar. Article 71(2) applies the Regulation from 11 December 2027, with two early carve-outs only: Article 14 from 11 September 2026, and Chapter IV (Articles 35–51) from 11 June 2026. Article 15 is not in that early list, so the Article 15 voluntary channel applies from 11 December 2027. Separately, ENISA’s SRP FAQ (Q6 / Q27) says voluntary SRP functionality is a later platform phase — today the portal accepts mandatory Article 14 AEV and severe-incident notifications only.

Can voluntary reporting replace a mandatory Article 14 filing?

No. If the facts meet Article 14 — reliable evidence of malicious exploitation, or a severe incident impacting product security — the manufacturer’s 24-hour / 72-hour / final-report duties run through the Single Reporting Platform. Article 15 is an optional wider channel; Article 15(3) even lets the coordinating CSIRT prioritise mandatory notifications over voluntary ones. Lab finds, bug-bounty disclosures and near misses without an Article 14 trigger stay off the mandatory clock (see also FAQ 5.2 on zero-days).

If a researcher files a voluntary report about our product, do we get told?

Only in the cases Article 15(4) lists. Where someone other than the manufacturer notifies an actively exploited vulnerability or a severe incident under Article 15(1) or (2), the coordinating CSIRT must inform the manufacturer without undue delay. Near misses and ordinary (non-AEV) vulnerability notices are not in that inform-the-manufacturer list — keep your own intake channel.

Does filing voluntarily create new CRA duties?

Article 15(5) says voluntary reporting must not impose additional obligations on the notifying person beyond what would have applied without the notification (criminal-law carve-out aside), and CSIRTs/ENISA must protect confidentiality. That shield does not erase a manufacturer’s separate Article 14 duty if the facts already meet the mandatory tests — confirm with counsel before treating a voluntary send as closing SRP.