The first part of the EU Cyber Resiliency Act comes into effect on September 11th. Are you Ready? | Blog | Endor Labs

What it is

Endor Labs' operational guide to the September 11, 2026 activation of Article 14 reporting under the EU Cyber Resilience Act (Regulation (EU) 2024/2847), read against the Commission's July 27 guidance C(2026) 5252 final. The summary states the deadlines and fine tiers; this page carries the scope boundaries, the "aware" defense, and exemptions the summary omits.

Preconditions / Affected

"Product with digital elements" means software supplied to a user and executed on the user's side. Browser extensions and locally installed apps — including Electron apps — are in scope. A web app or PWA running only in the browser is not in scope on that basis (NIS2 covers it), but ship a local client and its server-side dependency counts as a remote data-processing solution. The obligation applies to products already on the market before December 2027 and continues past end-of-support.

What to do

The reporting event turns on when you became "aware." Per paragraphs 213–214, you are aware only once an initial assessment gives reasonable certainty of active exploitation or a severe incident — you may verify a suspicion first, but the assessment must begin without delay regardless of source (customer, researcher, authority, press). Defend this with timestamps: when the report arrived, when assessment began, when you verified. Without that record, hindsight assumes the clock started at intake.

What does not start a clock: scanner findings, a published CVE with no exploitation in your product, coordinated disclosure, your own pentest results. There is no duty to hunt for exploitation.

One exception overrides the exploitation condition: a report of planted malicious code or a compromised build pipeline is a severe incident under Article 14(5)(b), reportable with no established exploitation.

Reachability is the deciding data point (paragraph 218): if a third-party component vulnerability is exploited in your product, report; if it cannot be or has not been exploited there, Article 14 falls away even when the same CVE is actively exploited elsewhere — leaving only voluntary Article 15 notification and telling the maintainer under Article 13(6).

flowchart TD
    A[Tip received] --> B[Begin assessment without delay]
    B --> C{Reasonable certainty of<br/>exploitation IN your product?}
    C -->|Yes| R[24h report via ENISA platform]
    C -->|No| D{Planted malicious code /<br/>compromised build?}
    D -->|Yes| R
    D -->|No| E[No Article 14 clock<br/>Art 15 voluntary only]

Caveats

Microenterprises and small enterprises are exempt from fines for missed reporting deadlines; open-source stewards face no administrative fines at all. The page notes fines aren't the worst exposure — market surveillance authorities can order withdrawal, prohibit availability, or recall. The 24h/72h windows are calendar hours: they run through weekends and holidays. Reports are confidential (CSIRT + ENISA), not public; Article 14(8) separately requires informing users, direct customers directly.