Does the ENISA SRP 72-hour counter match Article 14?

Not in the current release. ENISA's FAQ says the platform's 72-hour counter shows a due date 48 hours after you submit the 24-hour early warning, so a notification can appear overdue before 72 hours have passed since you became aware. The legal deadline in Article 14 is still 72 hours from becoming aware.

Is the SRP counter the legal deadline?

No. ENISA states that the counters are for visibility and reminder emails; they do not replace your duty to report without undue delay and within the Article 14 timelines.

When is the CRA 72-hour notification actually due?

Without undue delay and in any event within 72 hours of the manufacturer becoming aware of an actively exploited vulnerability or a severe incident, unless the relevant information has already been provided.

Does the SRP show a final-report counter for exploited vulnerabilities?

ENISA's FAQ says no counter is currently implemented for actively exploited vulnerabilities, because that final report is due no later than 14 days after a corrective or mitigating measure is available. For severe incidents, the platform shows a due date one month after submission of the 72-hour notification.

Should I delay the early warning so the SRP counter looks better?

No. Article 14 still requires the early warning without undue delay and within 24 hours of becoming aware. The platform display does not change that duty. Track awareness time yourself and file when the regulation requires it.

ENISA SRP 72-hour counter vs CRA Article 14 legal deadlines

What ENISA says about the counter

ENISA's Single Reporting Platform FAQ (question 26) explains how the platform calculates its 72-hour and final-report counters. In the current release, the 72-hour counter displays a due date and time 48 hours after submission of the 24-hour early warning. ENISA notes that, as a result, a notification may be displayed as overdue before 72 hours have elapsed since the manufacturer became aware of the event. A future release is planned to calculate that deadline from the awareness date/time field.

ENISA also states that these counters support reminders and visibility; they do not replace the manufacturer's responsibility to comply with Article 14, including reporting without undue delay and within the statutory timelines.

What Article 14 actually requires

Under Regulation (EU) 2024/2847, both the early warning and the 72-hour notification run from the same starting point: when the manufacturer became aware of an actively exploited vulnerability or a severe incident having an impact on the security of the product.

Early warning: without undue delay and in any event within 24 hours of becoming aware. What to send in the 24-hour early warning.
Notification: without undue delay and in any event within 72 hours of becoming aware. What to include in the 72-hour notification.

Filing the early warning early does not shorten the legal 72-hour window. The platform display can still make it look that way until ENISA updates the counter logic.

A simple example

You become aware at Monday 09:00. The legal 72-hour notification is due by Thursday 09:00. If you submit the early warning at Monday 12:00 (three hours later), the current SRP counter shows a due time 48 hours after that submission — Wednesday 12:00 — even though Article 14 still allows until Thursday 09:00. Treat Wednesday 12:00 as a portal reminder, not as the statute.

Final-report counters are different again

ENISA's FAQ draws a split that matches Article 14:

Actively exploited vulnerability: no final-report counter in the current release, because the deadline depends on when a corrective or mitigating measure becomes available (no later than 14 days after that).
Severe incident: the platform shows a due date one month after submission of the 72-hour severe-incident notification.

For the full chain, see CRA Article 14 reporting deadlines explained and what belongs in the final report.

How to track the real deadlines

Record the date and time you became aware, with who decided that and why.
Calculate 24-hour, 72-hour and final-report dates from that awareness time (and, for exploited vulnerabilities, from when a fix or mitigation is available).
Keep calendar reminders and an evidence log outside the portal.
Use the SRP counter as a visibility aid only until ENISA updates it to awareness time.
Do not hold the early warning back to make the portal counter look more generous.

Questions people ask

Does the ENISA SRP 72-hour counter match Article 14?: Not in the current release. ENISA's FAQ says the platform's 72-hour counter shows a due date 48 hours after you submit the 24-hour early warning, so a notification can appear overdue before 72 hours have passed since you became aware. The legal deadline in Article 14 is still 72 hours from becoming aware.
Is the SRP counter the legal deadline?: No. ENISA states that the counters are for visibility and reminder emails; they do not replace your duty to report without undue delay and within the Article 14 timelines.
When is the CRA 72-hour notification actually due?: Without undue delay and in any event within 72 hours of the manufacturer becoming aware of an actively exploited vulnerability or a severe incident, unless the relevant information has already been provided.
Does the SRP show a final-report counter for exploited vulnerabilities?: ENISA's FAQ says no counter is currently implemented for actively exploited vulnerabilities, because that final report is due no later than 14 days after a corrective or mitigating measure is available. For severe incidents, the platform shows a due date one month after submission of the 72-hour notification.
Should I delay the early warning so the SRP counter looks better?: No. Article 14 still requires the early warning without undue delay and within 24 hours of becoming aware. The platform display does not change that duty. Track awareness time yourself and file when the regulation requires it.

ENISA SRP 72-hour counter vs the legal Article 14 clock

The short version