The name, not the licence — the CRA reporting clock started on Friday, and not for everyone

Article 14 of the Cyber Resilience Act, Regulation (EU) 2024/2847, became applicable on 11 September 2026 and ENISA's Single Reporting Platform went live the same day: an early warning within 24 hours of awareness, a notification within 72, a final report within 14 days of a corrective measure, to the CSIRT designated as coordinator and ENISA rather than to a data protection authority, and triggered by reliable evidence that a malicious actor exploited the vulnerability in a system — not necessarily yours. The obvious reading, that the whole Regulation is a 2027 problem, is right about the main obligations and wrong about this one. The second and larger correction is that it did not start for everyone: Article 71(2) puts open-source software stewards on Article 24(3) from 11 December 2027, while Article 3(13) makes anyone who markets a product with digital elements under its own name or trademark a manufacturer, free of charge or not — so the licence does not decide the clock, the name does. The exposure inverts in the same direction: Article 64(2) puts Article 14 in the top penalty tier, EUR 15 million or 2.5% of worldwide turnover, alongside the essential requirements, while Article 64(10) exempts stewards from administrative fines entirely and exempts micro and small enterprises from fines for the 24-hour early warning specifically. The practitioner moves are to label every component in the agent stack manufacturer, steward or neither; to write the runbook trigger as evidence of exploitation anywhere rather than as an alert in your own estate; and to keep the 24-hour CRA clock separate from GDPR Article 33's 72 hours, because they run to different authorities.

Post

Yesterday a web form on ENISA's servers became mandatory. Most engineers I know still file the Cyber Resilience Act under "2027 problem".

Article 14 started on 11 September 2026. Regulation (EU) 2024/2847 applies in full from 11 December 2027 — the reporting duty did not wait for it, and ENISA's Single Reporting Platform went live the same day.

What actually changed for anyone shipping an agent stack in the EU:

The trigger is not your incident. Article 3(42) defines an actively exploited vulnerability as one with reliable evidence that a malicious actor has exploited it in a system, without the system owner's permission. Not your system. A system. Your SIEM can be silent and the clock still runs.
24 hours for the early warning, 72 for the notification, 14 days for the final report once a fix exists. Severe incidents: 24, 72, one month. GDPR gives you 72 hours for a personal data breach — this runs three times faster, and it goes to your CSIRT coordinator and ENISA rather than to a data protection authority.
It did not start for everyone. Article 71(2) puts open-source software stewards on Article 24(3) from 11 December 2027. Manufacturers started Friday.
Article 3(13) makes you the manufacturer if you market the product under your own name or trademark. Free of charge does not exempt you. The licence does not decide this — the name does.
The exposure inverts. Article 64(2) puts Article 14 in the top penalty tier, EUR 15 million or 2.5% of worldwide turnover, whichever is higher, alongside the essential requirements. Article 64(10) says stewards cannot be fined at all, and micro and small enterprises cannot be fined for missing the 24-hour early warning specifically — every other duty still stands for them.

For scale on what you would be reporting: Meta published Muse's security architecture on 8 September and prices a successful single-user prompt injection at up to $130,000 of a $300,000 maximum. That is the industry valuing the failure class that now opens a 24-hour window.

My Monday: one column beside every component in the stack — manufacturer, steward, or neither. An afternoon, and it decides who files.

Which of your components has your name on it?

#CyberResilienceAct #AIAct #AgenticAI #EUTech #DevSecOps

First comment

Sources, in the order the argument uses them.

ENISA's FAQ for the Single Reporting Platform — the 11 September 2026 start, and the Article 71(2) split that puts stewards on 11 December 2027: https://www.enisa.europa.eu/topics/product-security/single-reporting-platform-srp/frequently-asked-questions

The Commission's CRA page — entry into force 10 December 2024, reporting from 11 September 2026, main obligations from 11 December 2027: https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act

The Commission on open source — quotes Article 64(10) directly: stewards are not subject to administrative fines: https://digital-strategy.ec.europa.eu/en/policies/cra-open-source

Article 14 itself — the 24/72/14-day and 24/72/one-month sequences, and who receives them: https://www.european-cyber-resilience-act.com/Cyber_Resilience_Act_Article_14.html

Article 64 — the three penalty tiers, and the microenterprise carve-out for the 24-hour deadlines only: https://www.european-cyber-resilience-act.com/Cyber_Resilience_Act_Article_64.html

Meta's Muse security write-up, 8 September 2026 — the architecture, and the bounty figures: https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse

The Register's coverage of the start date, 11 September 2026: https://www.theregister.com/security/2026/09/11/eus-cyber-resilience-act-starts-the-24-hour-vulnerability-clock/5295821

Cut for length: the Commission published practical CRA guidance on 27 July 2026, which is the thing to read before you write the runbook rather than after.

Claims

Sources

Corrections

None.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice, the cover art and any background imagery are generated, and the brand ident animation is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.

The name, not the licence — the CRA reporting clock started on Friday, and not for everyone

Article 14 of the Cyber Resilience Act, Regulation (EU) 2024/2847, became applicable on 11 September 2026 and ENISA's Single Reporting Platform went live the same day: an early warning within 24 hours of awareness, a notification within 72, a final report within 14 days of a corrective measure, to the CSIRT designated as coordinator and ENISA rather than to a data protection authority, and triggered by reliable evidence that a malicious actor exploited the vulnerability in a system — not necessarily yours. The obvious reading, that the whole Regulation is a 2027 problem, is right about the main obligations and wrong about this one. The second and larger correction is that it did not start for everyone: Article 71(2) puts open-source software stewards on Article 24(3) from 11 December 2027, while Article 3(13) makes anyone who markets a product with digital elements under its own name or trademark a manufacturer, free of charge or not — so the licence does not decide the clock, the name does. The exposure inverts in the same direction: Article 64(2) puts Article 14 in the top penalty tier, EUR 15 million or 2.5% of worldwide turnover, alongside the essential requirements, while Article 64(10) exempts stewards from administrative fines entirely and exempts micro and small enterprises from fines for the 24-hour early warning specifically. The practitioner moves are to label every component in the agent stack manufacturer, steward or neither; to write the runbook trigger as evidence of exploitation anywhere rather than as an alert in your own estate; and to keep the 24-hour CRA clock separate from GDPR Article 33's 72 hours, because they run to different authorities.

Post

Yesterday a web form on ENISA's servers became mandatory. Most engineers I know still file the Cyber Resilience Act under "2027 problem".

What actually changed for anyone shipping an agent stack in the EU:

The trigger is not your incident. Article 3(42) defines an actively exploited vulnerability as one with reliable evidence that a malicious actor has exploited it in a system, without the system owner's permission. Not your system. A system. Your SIEM can be silent and the clock still runs.

24 hours for the early warning, 72 for the notification, 14 days for the final report once a fix exists. Severe incidents: 24, 72, one month. GDPR gives you 72 hours for a personal data breach — this runs three times faster, and it goes to your CSIRT coordinator and ENISA rather than to a data protection authority.

It did not start for everyone. Article 71(2) puts open-source software stewards on Article 24(3) from 11 December 2027. Manufacturers started Friday.

Article 3(13) makes you the manufacturer if you market the product under your own name or trademark. Free of charge does not exempt you. The licence does not decide this — the name does.

The exposure inverts. Article 64(2) puts Article 14 in the top penalty tier, EUR 15 million or 2.5% of worldwide turnover, whichever is higher, alongside the essential requirements. Article 64(10) says stewards cannot be fined at all, and micro and small enterprises cannot be fined for missing the 24-hour early warning specifically — every other duty still stands for them.

My Monday: one column beside every component in the stack — manufacturer, steward, or neither. An afternoon, and it decides who files.

Which of your components has your name on it?

#CyberResilienceAct #AIAct #AgenticAI #EUTech #DevSecOps

First comment

Sources, in the order the argument uses them.

The Commission on open source — quotes Article 64(10) directly: stewards are not subject to administrative fines: https://digital-strategy.ec.europa.eu/en/policies/cra-open-source

Cut for length: the Commission published practical CRA guidance on 27 July 2026, which is the thing to read before you write the runbook rather than after.

AI disclosure