Skip to main content

Article 14 reportability check

Article 14 of Regulation (EU) 2024/2847 (Cyber Resilience Act) requires manufacturers to report actively exploited vulnerabilities and severe security incidents.

The CRA Article 14 Reportability Checker at https://cvdportal.com/tools/reportability-check provides an anonymous, client-side triage tool. It evaluates whether an event requires statutory notification to ENISA and the national CSIRT coordinator.

How the triage tool evaluates events​

The tool evaluates three primary factors:

  1. Event type. The user selects a vulnerability, a security incident, or both.
  2. Active exploitation. For vulnerabilities, the tool asks for the evidence that Article 3(42) describes. Article 3(42) defines an actively exploited vulnerability as “a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner”. A proof of concept shows only that exploitation is possible.
  3. Severe incident. For security incidents, the tool shows the two tests of Article 14(5) in the words of the Regulation. One true test is enough.
    • “it negatively affects or is capable of negatively affecting the ability of a product with digital elements to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions” (Article 14(5)(a))
    • “it has led or is capable of leading to the introduction or execution of malicious code in a product with digital elements or in the network and information systems of a user of the product with digital elements” (Article 14(5)(b))

Statutory deadlines​

When an event triggers Article 14, the tool calculates live deadlines from the recorded awareness timestamp:

  • 24-hour early warning. The manufacturer must submit initial notification within 24 hours of becoming aware.
  • 72-hour notification. The manufacturer must submit detailed technical information within 72 hours of becoming aware.
  • Final report. For vulnerabilities, the final report is due within 14 days after a corrective measure is available. For incidents, the final report is due within one calendar month after the 72-hour notification. When both apply, each notification has its own final report, and the tool shows the earlier date.

The tool executes entirely in the web browser. It does not store data in a database and does not transmit notifications to authorities.