CRA Article 14 for zero-day vulnerabilities: when you must report

What FAQ 5.2 actually says

Commission CRA implementation FAQ entry 5.2 asks whether a manufacturer must report zero-day vulnerabilities. It quotes Article 3(42), then states the rule: vulnerabilities for which a patch or a security update is not yet available (so-called “zero-day vulnerabilities”) are subject to reporting in accordance with Article 14 when the manufacturer has reliable evidence that a malicious actor has exploited that vulnerability.

FAQ 5.2 also frames actively exploited vulnerabilities as cases where the manufacturer establishes that a security breach affecting its users or any other natural or legal persons resulted from a malicious actor making use of a flaw in a product with digital elements made available on the market. Weaknesses in identification and authentication functions are given as examples of the kind of flaw that can sit inside that definition — still only when the exploitation evidence is there.

Good-faith finds are not mandatory Article 14

Recital 68 says vulnerabilities discovered with no malicious intent for purposes of good faith testing, investigation, correction or disclosure to promote the security or safety of the system owner and its users should not be subject to mandatory notification. FAQ 5.2 turns that into two concrete examples:

• A zero-day found by ethical hackers, with no evidence of previous malicious exploitation, disclosed through a bug-bounty programme (Recital 76) — not mandatory Article 14.
• A zero-day found by a cybersecurity assessment laboratory testing on behalf of the manufacturer, again with no prior malicious exploitation — not mandatory Article 14.

In both cases FAQ 5.2 points to voluntary notification under Article 15 — a separate track from the mandatory early-warning / notification / final-report chain, with its own application calendar and SRP support status. Full split: Article 14 vs Article 15 voluntary reporting. For how awareness timing works once exploitation evidence does appear, see when the 24-hour clock starts.

When the zero-day is actively exploited

Once Article 3(42) is met, Article 14(1) requires notification of the actively exploited vulnerability contained in the product through the ENISA Single Reporting Platform. Lack of a patch does not pause the early warning (within 24 hours of becoming aware) or the fuller notification (within 72 hours). The final report for an AEV is due no later than 14 days after a corrective or mitigating measure is available — so the absence of a fix delays that last stage, not the first two. Clock overview: reporting deadlines explained. Field-level AEV walkthrough: notifying an actively exploited vulnerability.

If the zero-day sits in a library or chip you integrate, run the product-exploitation test in Article 14 for third-party components (FAQ 5.4) before assuming every integrator must file.

Operational triage in one pass

When a “zero-day” lands: (1) timestamp receipt and who assessed it; (2) ask whether there is reliable evidence of malicious exploitation in a system without the owner's permission — not merely a CVE, a high CVSS, or a missing patch; (3) if yes, start the Article 14 chain immediately and practice the dates on the free desk or deadline calculator; (4) if no, keep vulnerability handling running, treat Article 15 as the voluntary category (not a live SRP substitute today — see voluntary reporting), and restart the Art 14 triage the moment exploitation evidence appears. Official mandatory filing still goes through ENISA.

Questions people ask

Do we have to report every zero-day under Article 14?

No. Commission FAQ 5.2 says zero-days — vulnerabilities for which a patch or security update is not yet available — are subject to Article 14 only when the manufacturer has reliable evidence that a malicious actor has exploited that vulnerability. No patch is not the same as actively exploited.

What is the legal test for “actively exploited”?

Article 3(42) defines an actively exploited vulnerability as one for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner. FAQ 5.2 adds that this concerns a security breach affecting users or others that resulted from a malicious actor using a flaw in a product with digital elements you made available on the market.

A researcher found a zero-day in our bug bounty. Mandatory SRP filing?

Usually not on that fact alone. FAQ 5.2’s worked example: a zero-day discovered by ethical hackers, with no evidence of previous malicious exploitation, disclosed through a bug-bounty programme (see Recital 76), is not an actively exploited vulnerability subject to mandatory reporting. Recital 68 steers good-faith testing, investigation, correction or disclosure away from mandatory notification. Article 15 voluntary notification remains open.

Our lab found a zero-day in our own product during assessment. Same answer?

Yes under FAQ 5.2: a zero-day discovered by a cybersecurity assessment laboratory testing on your behalf, with no evidence of previous malicious exploitation, is not mandatory Article 14. Treat it through vulnerability handling; start the 24-hour clock only if reliable exploitation evidence appears later.

We have exploitation evidence but no patch yet. Do early warning and 72-hour wait for a fix?

No. Once you have reliable evidence of malicious exploitation, Article 14(1)/(2) early warning (24 hours) and notification (72 hours) run from awareness. Only the final report for an actively exploited vulnerability is timed from when a corrective or mitigating measure is available (within 14 days after that). Waiting for a patch does not pause the first two stages.

If it is not mandatory, can we still tell ENISA / a CSIRT?

FAQ 5.2 points manufacturers to Article 15 for zero-days that are not actively exploited. Article 15 itself applies from 11 December 2027 (Article 71(2) early-applies only Article 14 and Chapter IV), and ENISA SRP FAQ Q27 says voluntary portal submissions are a later phase. See our Article 14 vs Article 15 guide. Mandatory Art 14 filings still go through the Single Reporting Platform when the AEV test is met.