The day an Article 14 case opens

euvex cross-checks the SBOM of the scan linked to a product with CISA's catalogue of actively exploited vulnerabilities, known as KEV: when you create the product or link a scan to it, when you upload a linked scan, then at each daily recheck. A build component, marked as such, does not count; a component whose distribution is unknown does count.

A case opens per product, per vulnerability and per component. It is in the console, under “Signalements” (reports), and an email goes to the account's address if it is confirmed, one per pass, grouping all your products concerned.

The KEV catalogue is a US source, with no legal standing in the CRA. It attests an exploitation observed somewhere, not necessarily in your product or your configuration. That is why what follows starts with an assessment, your own.

A case can also be opened by hand, from a product's “Signalements” page: for a severe incident, which euvex cannot detect, or a vulnerability not in the scan, in your own firmware for example.

The obligation concerns an actively exploited vulnerability “contained in the product with digital elements” (Art. 14(1)). The Regulation defines the former as “a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner” (Art. 3, point 42).

The questions the case does not settle for you:

• Is the component really in the product placed on the market, in the affected version?
• Is the vulnerable part present and reachable in your configuration?
• When did you become aware of it: you, not euvex?

If you conclude that no notification is due, keep a record of your reasoning in your documentation, then “Clore le dossier” (close the case): it stays available, and can be reopened. This assessment is a question of law and engineering; an adviser can help you with it, euvex does not do it.

The first two apply “without undue delay and in any event” within those periods. The final report never runs from becoming aware: for a vulnerability, it waits until a measure exists, and a mitigating measure is enough to trigger it, not only a fix; for an incident, it runs from the submission of the notification.

The notification and the final report are due “unless the relevant information has already been provided”. Judging this exemption is up to you: euvex does not show it as a checkbox, so as not to invite skipping a step.

In the case, each deadline carries its date in UTC and its status: “À déposer” (to submit), “Échéance dépassée” (deadline passed), “Déposé” (submitted), “Déposé hors délai” (submitted late), or “Échéance non déclenchée” (deadline not triggered) as long as its starting point is unknown. Never an invented date.

When euvex opens a case, it enters the time at which it picked it up: the upload or linking of the scan, or its daily recheck. That is not necessarily your own. If you knew earlier, from a supplier's advisory or a researcher, correct the date: it drives the early warning and the notification.

Dates are entered in UTC, and none can be in the future. For a vulnerability, the date of the corrective or mitigating measure is entered in the same place, on the day it is available: it triggers the final report.

The scan revision in which the vulnerability was picked up is dated in the scan's file, under “Surveillance dans le temps” (monitoring over time): two separate documents carrying the same date.

euvex prepares a draft early warning, and a field per step for drafting the next ones. What the text asks for at the very least:

Submission goes through the single reporting platform established by ENISA (Art. 16), using the notification end-point of the CSIRT designated as coordinator of the Member State of your main establishment in the Union; the notification is simultaneously accessible to ENISA (Art. 14(7)). The CSIRT may ask you for an intermediate report (paragraph 6).

Once the step is submitted, tick “Déposé sur la plateforme unique” (submitted on the single platform) in euvex, enter the submission date in UTC, and save. For an incident, this notification date sets the final report.

After becoming aware of an actively exploited vulnerability or a severe incident, the manufacturer informs the impacted users, and where appropriate all users, with the measures they can deploy, where appropriate in a structured, machine-readable format. euvex does not do it for you, and keeps no list of your users.

The “Dossier imprimable” (printable file) sets out the dates, submissions and texts of each step. Keep it with your technical documentation. “Clore le dossier” (close the case) marks it closed without erasing it, and “Rouvrir le dossier” (reopen the case) reopens it.

As long as a case is open, the scan it depends on cannot be erased. Deleting an account or a scan.

• Regulation (EU) 2024/2847, the Cyber Resilience Act. Article 3, point 42; Article 14, paragraphs 1, 2, 4, 6, 7 and 8; Article 16. Article 14 is applicable from 11 September 2026 (Art. 71(2)).
• The KEV catalogue, what it covers and what it does not: our sources.
• All the deadlines, with their article: the key dates.