CRA Article 14 vs Article 13 vulnerability handling: live now vs December 2027

What Article 13 / Annex I Part II actually requires

Article 13 is the manufacturer-obligations spine for design, development, production and ongoing vulnerability handling. Article 13(1) ties products to Annex I Part I essential cybersecurity requirements. Article 13(8) requires manufacturers, when placing a product with digital elements on the market and for the support period, to ensure that vulnerabilities — including in components — are handled effectively in accordance with Annex I Part II. The support period must reflect expected use time (at least five years unless expected use is shorter), and manufacturers must have appropriate policies and procedures, including coordinated vulnerability disclosure policies referred to in Part II, point (5).

Article 13(6) adds the upstream component path: upon identifying a vulnerability in an integrated component (including open-source), report it to the person or entity manufacturing or maintaining that component, and address and remediate it under Annex I Part II; where you develop a software or hardware modification, share the relevant code or documentation where appropriate. Article 13(9) keeps security updates available after issue for a minimum of 10 years or the remainder of the support period, whichever is longer. Annex I Part II is the essential-requirements list for those processes (including SBOM under Part II, point (1), and security updates under Part II, point (8)) — process conformity, not a CSIRT filing form.

Article 14 stays on the SRP reporting track

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger (14 days after a corrective or mitigating measure is available for an AEV under Article 14(2)(c), or within one month of the 72-hour notification for a severe incident under Article 14(4)(c)) — through ENISA's Single Reporting Platform to the coordinating CSIRT. That duty has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)).

Clock detail lives in the reporting deadlines and becoming-aware guides. Measure-available finals: Article 14(2)(c) corrective or mitigating measure.

The calendar split under Article 71(2) and FAQ 7.1

Article 71(2) is short and easy to flatten into one “CRA start date.” The Regulation applies from 11 December 2027. The early applications listed are Article 14 (from 11 September 2026) and Chapter IV on conformity-assessment bodies (Articles 35–51, from 11 June 2026). Commission FAQ 7.1 states the same split in plain terms: reporting obligations in Article 14 from 11 September 2026; obligations to ensure products conform with the essential cybersecurity requirements in Annex I, market surveillance and enforcement, and the other CRA provisions from 11 December 2027. Annex I Part II vulnerability handling sits in that later package — it is not what made the SRP clock start in September 2026.

The trap: “we’re doing vulnerability handling, so reporting can wait”

Two failure modes show up in triage. First: a team builds SBOM, CVD and patch process for the December 2027 conformity date and treats Article 14 as part of that same project — missing live AEV or severe-incident clocks on products already on the Union market. Second: a team that already patches and discloses assumes the SRP early warning is optional because “we handle vulns internally,” or confuses Article 13(6) upstream maintainer notice with coordinating-CSIRT notification. Process work and SRP filing are different jobs on different calendars.

Neighbouring traps: end of support does not end Article 14; legacy products still report under Article 69(3) / FAQ 5.3; Article 15 voluntary is not a live substitute for mandatory Article 14; zero-days without exploitation evidence stay in vulnerability handling until Article 3(42) evidence appears; third-party components turn on FAQ 5.4 (exploited in your product vs upstream Art 13(6) path); CE marking / EU declaration of conformity is the same Dec 2027 conformity calendar — missing a CRA CE/DoC is not an Article 14 holiday either.

If you're building both tracks

Run Article 14 from awareness when an AEV or severe-incident trigger is met — today — while you continue building Annex I Part II processes toward 11 December 2027. Do not let an unfinished vulnerability-handling programme pause an SRP early warning, and do not treat an SRP submission as proof that Part II conformity is done. What you can share across both is your internal timeline: what you knew, when you knew it, what you remediated, and what you filed. The evidence log is built for that. Other parallel regimes (NIS2, CER, DORA, GDPR, AI Act) still do not substitute for either track.

Questions people ask

Does running a vulnerability-handling programme satisfy Article 14?

No. Article 13 and Annex I Part II are product-lifecycle / process duties: handle vulnerabilities effectively during the support period (identify and document, address and remediate, coordinated vulnerability disclosure policies, security updates, SBOM, and related essential requirements). Article 14 is a separate awareness-triggered duty to notify actively exploited vulnerabilities and severe incidents through ENISA’s Single Reporting Platform. Having a CVD intake or a patch pipeline does not file an early warning.

When does each set of duties apply?

Article 71(2): Article 14 applies from 11 September 2026; the Regulation generally applies from 11 December 2027 — that later date is when manufacturer conformity with Annex I (including Part II vulnerability handling) and the rest of the package apply for most products. Commission FAQ 7.1 spells out the same split: reporting from 11 September 2026; essential cybersecurity requirements in Annex I, market surveillance and the other CRA provisions from 11 December 2027. Do not wait for Dec 2027 conformity before running the SRP chain on an in-scope product.

We already patch and disclose under our CVD policy. Why is there still a 24-hour clock?

Because Article 14 starts from becoming aware of an actively exploited vulnerability (Article 3(42)) or a severe incident with impact on the product’s security (Article 14(5)), not from shipping a fix. The 24-hour early warning and 72-hour notification run to the coordinating CSIRT and ENISA via the SRP even while your Annex I Part II remediation work is still open. The AEV final report is timed from when a corrective or mitigating measure is available (Article 14(2)(c)), which is a reporting close-out — not a substitute for the early stages.

If Annex I Part II is not yet mandatory, do we still have to report AEVs on products already on the market?

Yes for in-scope products. Article 69(3) applies Article 14 reporting to products with digital elements placed on the market before 11 December 2027. Commission FAQ 5.3 adds that for those products you may still have to notify even when investigation or full vulnerability handling is practically impossible — tooling gone, old builds unreproducible — without that alone recreating the full Annex I Part II package. See also the legacy-products and after-support-period guides.

Is Article 13(6) component reporting the same as Article 14 SRP filing?

No. Article 13(6) tells manufacturers who identify a vulnerability in an integrated component (including open-source) to report it to the person or entity manufacturing or maintaining that component, and to address and remediate it under Annex I Part II. That upstream path is not ENISA SRP notification. FAQ 5.4 turns on whether the flaw is actively exploited in your product for Article 14; a non-exploitable-in-your-product component find may sit with vulnerability handling / Article 15 voluntary channels instead. Confirm with counsel how the Article 13 limb applies on your product timeline before 11 December 2027.

Is this the same as Article 15 voluntary reporting?

Related family, different track. Article 15 voluntary notifications of vulnerabilities, near misses and incidents that are not mandatory under Article 14 follow the general CRA application date (11 December 2027) and are not yet the live SRP mandatory portal. Article 13 / Annex I Part II is the conformity vulnerability-handling package. Article 14 is the live mandatory AEV / severe-incident chain. See the voluntary-reporting guide for the Art 14 vs Art 15 split.