A CVE in a library your product ships turns up on CISA's exploited list overnight. From that signal, Article 14 asks two things: whether the vulnerability is being actively exploited in your product, and, if it is, an early warning within 24 hours of your becoming aware. The Commission's guidance puts that moment at the end of your initial assessment. A dated vciy record of the assessment says when it started, what you knew, and what you found.
No CVE to hand? Open an investigation on CVE-2023-44487, this page's worked example: HTTP/2 Rapid Reset, a flaw in a protocol shipped inside many products. Not sure which CVEs touch what you ship? Check your software, free and with no account.
The record opens with that CVE's facts already filled in: KEV status, EPSS and its date, weakness class, fixed versions, each from its public source. Our server dates it. Sign in with email, Google or GitHub to keep it. The first 100 records are free.
Article 14 binds manufacturers of products with digital elements sold in the EU. It applies from 11 September 2026, ahead of the rest of the Regulation.
| Reference | What it says | What it means for a CVE in your product |
|---|---|---|
| Art. 3(42) definition | "'actively exploited vulnerability' means a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner" | A CVE with a score is not enough. It is the evidence of exploitation that makes it reportable. |
| Art. 14(1) | "A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator ... and to ENISA." | One submission reaches both, through ENISA's Single Reporting Platform. |
| Art. 14(2)(a) early warning | "an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it" | The 24 hours run from awareness, not from the CVE's publication or its KEV listing. |
| Art. 14(2)(b) vulnerability notification | "without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively exploited vulnerability, which shall provide general information, as available, about the product with digital elements concerned, the general nature of the exploit and of the vulnerability concerned as well as any corrective or mitigating measures taken" | What you knew, and what you did, by hour 72. |
| Art. 14(2)(c) final report | "no later than 14 days after a corrective or mitigating measure is available", including "a description of the vulnerability, including its severity and impact" and "details about the security update or other corrective measures" | Counted from the fix, so the day a fix existed is the next date you will need. |
| Art. 14(8) | "the manufacturer shall inform the impacted users of the product with digital elements ... where appropriate in a structured, machine-readable format that is easily automatically processable." | Your customers hear it from you, not only the CSIRT. |
| Art. 71(2) | "This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026" | The reporting duty is live now; the product requirements follow in December 2027. |
The Regulation does not define awareness. The Commission's guidance on applying it does, and it also settles two questions every product team asks first.
| Guidance | What it says | What it asks you to be able to show |
|---|---|---|
| Para. 213 when awareness starts | "the manufacturer should assess the suspicious event immediately ... The manufacturer is therefore to be regarded as having become aware when, after such an initial assessment, it has a reasonable degree of certainty that: (i) a vulnerability contained in its product with digital elements is being actively exploited" | When the signal reached you, that you assessed it at once, and when the assessment reached certainty. |
| Para. 217 before 11 September 2026 | "the manufacturer is not required to report vulnerabilities of whose active exploitation it had already become aware before 11 September 2026" | That your awareness came before that date. A record dated before it says so. |
| Para. 218 a component you ship | "if a manufacturer is aware that a third-party component contains a vulnerability, but that vulnerability either (i) cannot be exploited in its product with digital elements (e.g. because the vulnerable code is not reachable) or (ii) has not been exploited in its product with digital elements, that vulnerability does not qualify as an actively exploited vulnerability contained in its product" | Why a CVE in your bill of materials was not reportable for you: the reasoning and the date of it. |
The reporting platform counts from your early warning. ENISA's FAQ for the Single Reporting Platform: "In the current release, the 72-hour counter displays a due date/time 48hrs after submission of the 24-hour Early Warning." It says the counter will later use the "Date/Time when you became aware" field, and that it does not replace the legal timing. Until then, the moment you became aware is yours to keep.
| The question | What answers it |
|---|---|
| When did the signal reach you? | The alert itself. A watched product's KEV listing or public proof-of-concept arrives with the day the source published it and the time vciy learned it, both kept. |
| When did your assessment start, and on what? | An investigation record, opened when you began: what happened, the products and other CVEs involved, who owns it, and the CVE's facts that day (KEV status, EPSS and its date, affected versions, fixed versions) frozen into it and hashed. Our server sets its date; nobody can set an earlier one, including you. |
| When did it reach certainty, and what did you find? | The version that closes the investigation, with its own date and your finding. If evidence moves while it is open, a KEV listing or a new proof-of-concept, you hear about it on that record. |
| Why was a component CVE not reportable for you? | A not-affected record with your reason ("the vulnerable code is not reachable in our build"), dated, with the day's evidence beside it. If the affected versions are later revised to cover yours, that record tells you. |
| Did you know before 11 September 2026? | Any record dated before it. The date is the server's, so it cannot be written afterwards. |
What vciy does not do. It does not submit to ENISA's Single Reporting Platform, write the notifications for you, or decide whether a vulnerability is being exploited in your product. That judgement is yours; the record keeps it, with its date and its evidence. Nothing on this page is legal advice.
The early warning is due within 24 hours of awareness. Without a dated assessment, the earliest date anyone can prove becomes the one you are held to. A record made as you assess is already there when someone asks.
| Tier | What it gives you under Article 14 |
|---|---|
| Free $0, named Community on the pricing page | Investigations and not-affected records, dated, with the day's evidence, and alerts when new evidence lands on them. Start free |
| Practitioner $20 a month or $200 a year. | Every product you ship watched, searchable history, and exports of each record a reviewer can check without us. |
| Custody $10,000 a year. | A team-wide history with access logs, for a regulator's or a customer's review. Custody starts with an evidence review: write to sales@vciy.com. |
The record format is open: what a decision record is. For the other standards an exception answers to, see the compliance pages.