Article 14 has been in force since 11 September 2026
On 11 September 2026 the EU Cyber Resilience Act's reporting obligations became enforceable. If a vulnerability in a product you've placed on the EU market is being actively exploited, you owe an early warning to your national CSIRT and ENISA within 24 hours of becoming aware.
Two regulations, two different questions. This page is the CRA: is anything you ship being actively exploited right now, on a 24-hour clock. The other is the Product Liability Directive: can you still supply security updates for what you shipped, for products placed on the market from 9 December 2026. Different questions, different answers — free tools for both (cra-watch, pld-watch).
Most of the CRA doesn't bite until December 2027. This part is live now — and it applies to products you shipped years ago that are still on the market.
Legal basis: Regulation (EU) 2024/2847, Article 14. Products placed on the EU market before 11 December 2027 are in scope (Article 69(3)). Non-compliance sits in the CRA's highest penalty tier — up to €15 million or 2.5% of worldwide annual turnover (Article 64(2)). One nuance worth stating precisely, because it is widely got wrong: Article 64(10)(a) relieves microenterprises and small enterprises of the administrative fines in paragraphs 3 to 9 for missing the 24-hour early-warning deadline in Article 14(2)(a) or Article 14(4)(a). It does not reach the Article 64(2) fines quoted above — that is the paragraph carrying the €15 million / 2.5% figure, and it is the one that covers Article 14. So being small does not exempt you from the headline tier, and the relief covers the deadline only — not the duty to report, and not the 72-hour or final-report stages.
Start with the free part. cra-watch reads your lockfiles, resolves them
against OSV.dev, and intersects the result with the CISA Known Exploited Vulnerabilities
catalogue — the closest public register of what is genuinely being exploited in the wild.
Not "here are 400 CVEs, good luck." One question: is any of it on the known-exploited list today?
$ cra-watch scan Advisories 13 component(s) carry at least one known advisory KEV feed 1709 entries, catalogue 2026.09.11 NO KEV MATCHES. No KEV matches were found in this example. This is not a determination that Article 14 reporting is unnecessary. Other evidence of exploitation or a severe incident may require reporting.
Or the other answer:
2 KEV MATCH(ES) - MANUAL DECISION REQUIRED NOW CVE-2021-44228 (GHSA-jfh8-c2jp-5v3q) component org.apache.logging.log4j:log4j-core 2.14.1 [Maven] known as Apache Log4j2 Remote Code Execution Vulnerability KEV listed 2021-12-10 ransomware use: Known Illustrative example: awareness recorded at 2026-09-14 08:40:10 UTC. For an actively exploited vulnerability affecting an in-scope product: Early warning within 24h 2026-09-15 08:40:10 UTC Notification within 72h 2026-09-17 08:40:10 UTC Final report within 14 days after a corrective or mitigating measure is available. No final-report date is inferred from awareness alone.
For severe incidents, the final report is due within one month of the 72-hour notification. Check the European Commission reporting guidance and your applicable reporting obligations. These examples are educational, not legal advice.
Free, MIT licensed, standard library only, no account, no telemetry. 12 lockfile formats plus CycloneDX and SPDX SBOMs. Exit codes designed to be a CI gate.
Check a lockfile right now — free, in your browser → or get the CLI on GitHub
Run it on a schedule, not just on push. The KEV catalogue gains entries continuously — a repo that was clean yesterday can be a reporting question today without a line of your code changing.
Read a synthetic evidence-log sample before buying. It shows the format, not a real customer incident.
The tool narrows a thousand CVEs to a shortlist. It cannot tell you whether to file — because Article 14's actual test is whether the vulnerability is being exploited in your product, and that's a human judgement about reachability, evidence, and timing.
That judgement is where organisations come apart under a 24-hour clock. Who is accountable for pressing send? What does an early warning say when you still know almost nothing? What defends a decision not to report, eight months later, to a market surveillance authority?
The clock starts when you have a reasonable degree of certainty after an initial assessment — not when a rumour arrives, and not when you finish the investigation.
The kit is the process around the decision: written in advance, so the 24 hours are spent deciding rather than inventing a procedure.
security.txt, a disclosure policy, an intake and triage
runbook, the advisory and CVE process, and the five files that belong in every repo.
Five editable chapters, buyer instructions and a combined PDF.Secure checkout by PayPal — card or PayPal balance, no account required. After payment this page shows your order reference and a prefilled message that claims your files; they are sent by a person in reply to it.
The single licence above covers one organisation. This one covers you deploying the kit into client engagements — consultancies, fractional CISOs, MSPs, and groups running several legal entities.
You still may not resell the pack itself as a product or publish it publicly. It's a licence to use it in your work, not to republish it.
Manual email delivery after payment verification. Same 14-day refund.
The kit tells you how to decide. This tells you where you currently stand — a dated, reproducible, organisation-specific assessment of your real dependency graph, written up as a document you can hand to a board, an auditor, or a customer asking what you've done about the CRA.
Not currently available. This one needs work done after you pay, and we will not take money for something whose delivery depends on capacity we cannot guarantee. Everything the assessment is built on is public: the method is cra-watch, which is MIT-licensed and runs on your own machine, and the decision procedure is the $149 kit above. You can produce the same result yourself, today, for free.
Separate from the CRA, if you run anything on AWS there's a second clock: retired Lambda runtimes, Amazon Linux 2, deprecated SDK versions. Same shape of problem — a real deadline, and the hard part is knowing exactly which files are affected.
app/infra/template.yaml:5 — Runtime: python3.8How it works: this report is now fully self-serve at eolkits.com/audit — upload a repository ZIP, pay, and the report is generated and delivered automatically. No email step and nothing waiting on a human.
Honest limitation, stated in the report itself: this is a static scan of what you upload. It does not query a live AWS account, execute code, prove exploitability, or guarantee a complete resource inventory. Validate every change in a non-production environment. If we can't scan what you send, full refund.
| File | What it does |
|---|---|
| 00-START-HERE | The first hour. A ten-line quick start for someone who just got the call. |
| 01-DECISION-TREE | Report / don't report, as an ASCII tree and a numbered checklist. |
| 02-TIMELINE-AND-CLOCKS | The cascade, worked in UTC, including what to file when you still know nothing. |
| 03-REPORT-TEMPLATES | Early warning, 72-hour, final. Fill in the blanks. |
| 04-EVIDENCE-LOG | Contemporaneous record template, with a filled example. |
| 05-ROLES-AND-DRY-RUN | Who does what, plus a 30-minute tabletop you can run this week. |
Delivered as Markdown (editable, diffable, drop it in your repo next to your incident runbooks) plus a single combined PDF for people who want to print it and put it on a wall.
You manufacture a product with digital elements — software, hardware, a connected device, a component sold separately — and it's available on the EU market. Directly, or through an importer, distributor, or authorised representative. Being based outside the EU doesn't remove the obligation.
You're probably a team of 5 to 200 without a dedicated regulatory function, where the person who'd have to file is also the person shipping features. The kit exists so that person has a procedure instead of an afternoon of reading a regulation.
If you have in-house regulatory counsel who've already drafted your Article 14 procedure, you don't need this. If you're looking for a compliance certificate, nothing here is one, and anyone selling you one is selling you something that doesn't exist.
Different regulation, different question. The CRA asks whether anything you ship is being actively exploited right now, on a 24-hour reporting clock. From 9 December 2026 the EU Product Liability Directive asks a separate question: can you still supply security updates for what you shipped? Software becomes a “product” under no-fault strict liability.
The EU Product Liability Directive Kit → · free tool: pld-watch finds what is past end-of-life in your project.
Keep your order reference. It is what releases your files — they are not served from a public link.
Yes. MIT licensed, on GitHub, no account, no telemetry, no upsell inside the tool. It's genuinely useful on its own and I'd rather it were widely used than gated.
No, and the tool says so explicitly. KEV evidences exploitation somewhere in the world. Article 14 asks about exploitation in your product. If the vulnerable code path is unreachable in your build, the answer may be no. The kit's decision tree walks that distinction, and the evidence log is how you record the reasoning.
No. It's a US government catalogue — it lags, and it isn't exhaustive. Your own telemetry or a customer's incident report can start the clock before CISA lists anything. KEV is a strong, free, public signal. It isn't the boundary of the obligation.
The files are delivered manually by email after payment verification. If it's not what you expected, email within 14 days and you get your money back, no argument. Refunds go back through PayPal to the original payment method.
The purchase is the current version, and you get any revision published in the 12 months after you buy at no extra cost — emailed to the address you paid from. To be straight with you: that's a document-revision commitment, not a support contract or a subscription. There's nothing to cancel.
Toledo Technologies LLC, a US software company. The tool and the kit were built because the deadline is real and the gap between "here are your CVEs" and "file or don't file, in 24 hours" is where teams actually get stuck.