Report exploited vulnerabilities from 11 September: ENISA's platform is live
Practical impact Adds or clarifies a duty
From 11 September 2026 manufacturers must notify actively exploited vulnerabilities and severe incidents affecting the security of their products with digital elements (Article 14 of the CRA, applicable under Article 71(2)).
Reporting duty (Art. 14) Installed base