Your suppliers have owed you notice of exploited vulnerabilities since 11 September, and that duty has no deadline.
The authorities get 24 hours, then 72, then a final report. You get the words shall inform, with the timing left to a CSIRT's judgement if your supplier does not get round to it.
What this achieves, and what it does not
By the end of this you will be able to say, for every supplier whose software or connected hardware you run: where a notice about an actively exploited vulnerability would arrive, who in your organisation reads that place, and whether anybody has ever tested it.
That is all it achieves. It is more than most organisations can answer today, and it is a Monday morning's work rather than a project.
What it does not fix:
- It does not make your suppliers' products secure. The Cyber Resilience Act's requirements about how a product is built apply from 11 December 2027. What applies now is the reporting article, and only that.
- It does not get you the reports sent to ENISA. Those go to the CSIRT designated as coordinator and to ENISA through a single reporting platform. You are not on that distribution.
- It does not cover everything you run. The Act covers products with digital elements made available on the EU market. Your bespoke internal application, written by your own staff and never placed on the market, is not somebody else's product and nobody owes you a notification about it.
If what you actually need is an inventory of what you run, stop here and build that first. This procedure assumes you have one.
What you need, and how long it really takes
You need the supplier list, which for most organisations lives in accounts payable rather than in IT, and access to whatever mailbox your vendor notifications currently land in.
Two to four hours for twenty suppliers if their notification pages are easy to find. A day if they are not, and they often are not: the long end of the range is almost entirely the time spent working out whether a vendor's "security advisories" page is a mailing list you can subscribe to or a page somebody updates when they remember.
Why there is a gap to close at all
Article 14 of the Cyber Resilience Act applies from 11 September 2026. It gives the manufacturer three clocks, all of them pointing at the authorities:
an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours
Then a fuller vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available.
Then paragraph 8, which is the one that concerns you:
After becoming aware of an actively exploited vulnerability or a severe incident having an impact on the security of the product with digital elements, the manufacturer shall inform the impacted users of the product with digital elements, and where appropriate all users, of that vulnerability or incident
Read the two together. The duty to tell you is real, express and unconditional as to whether — and it contains no period at all. The only timing language anywhere near it is in the next sentence, which lets a notified CSIRT tell users itself where the manufacturer "fails to inform the users of the product with digital elements in a timely manner".
So the enforcement of your notice is a judgement made by a national CSIRT about somebody else's promptness. That is not nothing. It is also not a date you can put in a plan.
The steps
1. Pull the supplier list from accounts payable, not from IT. You are looking for anyone you pay for software or connected hardware. Expect it to be longer than the list IT would have given you, and expect the surprises to be at the small end.
2. For each supplier, find the notification channel. You are looking for the specific place a security notice appears. Acceptable answers: a mailing list you can subscribe to, a feed with a URL, a portal that sends email. Not acceptable: a page on their website. A page is not a notification.
3. Write down the channel and the date you checked it. One line per supplier. This is the deliverable; everything else is in service of it.
4. Find out who in your organisation receives it, by name. Not "the security mailbox". A person. If the answer is an address created by somebody who has left, you have found the actual finding of this exercise and it is worth the morning on its own.
5. Send one message through each channel you control. Subscribe, confirm, and check it arrives somewhere a human will see within a working day. Where the channel is the vendor's own portal, log in and confirm your notification preferences are on — they default off more often than you would like.
6. For anything you cannot resolve, email the supplier and ask one question. Where will you send a notification under Article 14(8) of the Cyber Resilience Act, and to which of our addresses. Cite the article; it changes the answer you get. Give them two weeks and record who did not reply, because that is also an answer.
7. At the next renewal, put a period in the contract. The regulation does not give you one, so you buy one. Twenty-four hours to match their authority-facing clock is the obvious ask and some will take it. Seventy-two is winnable almost everywhere. Add that the notice goes to a named role rather than an individual, and that it comes in a machine-readable form where they have one — Article 14(8) already contemplates that, which makes it a smaller ask than it sounds.
How to tell it worked
You can name, without looking anything up, the two suppliers most likely to be the source of your next incident and say exactly where their notice would land and who opens it.
If you cannot do that, you have a list rather than a procedure.
How to undo it
Nothing here is destructive. The one change worth reversing carefully is step 5: if you redirect vendor notifications into a shared mailbox, leave the old addresses forwarding for a quarter rather than closing them, because the notice you miss will be from the vendor whose record you updated last.
What comes next
11 December 2027, when the rest of the Act applies and the questions become about how the product was built rather than about who gets told when it breaks. The answers you write down this week are the input to that conversation, and they are the part nobody will want to do twice.
Written from
Primary The document itself. Claims in this piece rest only on these.
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 14 and 71Read directly on EUR-Lex for this piece. Article 14(1) and 14(2) quoted in full for the three authority-facing deadlines — early warning within 24 hours, vulnerability notification within 72, final report no later than 14 days after a corrective or mitigating measure is available — and for the routing to the CSIRT designated as coordinator and to ENISA through the single reporting platform under Article 16. Article 14(8) quoted in full for the duty owed to users, including the absence of any period in it and the fallback allowing notified CSIRTs to inform users themselves where the manufacturer fails to do so in a timely manner. Article 71(2) for the application dates: the Regulation applies from 11 December 2027, but Article 14 applies from 11 September 2026 and Chapter IV from 11 June 2026.
- A correction this desk is making to itselfAn earlier internal note for this piece recorded that the Cyber Resilience Act obliges a manufacturer to tell ENISA and says nothing about telling the customer. That is wrong, and reading Article 14(8) is what established it. The duty to inform users exists and is express. What it lacks is a period, which is a narrower and more useful finding than the one it replaced, and the body is built on the text rather than on the note.
- Whether any supplier has in fact notified under Article 14(8), and what those notices look likeNot established. This desk has not seen an Article 14(8) notice, has not surveyed suppliers, and makes no claim about whether the duty is being honoured in practice since 11 September. The procedure below is written from the text and from how notification channels usually fail, not from a sample of notices. Step 4 exists precisely because the honest answer to 'does your supplier do this' is that you will have to find out yourself.
- The delegated act under Article 14(9) on delaying dissemination of notificationsArticle 14(9) required the Commission to adopt delegated acts by 11 December 2025 specifying the terms and conditions for applying cybersecurity-related grounds to delay dissemination of notifications under Article 16(2). Whether that act has been adopted was not established here. It governs the authorities' handling rather than the manufacturer's duty to users, so nothing in this procedure turns on it, but a reader wanting the full picture of who learns what and when should chase it.