Home / The regulation / Monthly digest Monthly, counts only
How the exploited list moved this month Once a month: how many vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalogue, and how many of them sit in components that appear in inventories watched here. Two numbers and a sentence. It is not a list of vulnerabilities, it names no product, and nothing else is ever sent to the address.
Why a count: the reporting duty turns on exploitation of your product, and a catalogue entry is a reason to assess, not a reportable event.Art. 14(1)
Want the answer for your own product instead of a count? Check an SBOM against the catalogue now — free, no account, and the file is not stored.
Past issues Also on this
Article 14 What Article 14 of the Cyber Resilience Act requires: who reports, when the 24-hour, 72-hour and final clocks start, and which authority receives each filing.
Filing on the platform Every field the ENISA platform asks for at each of the three stages, who may submit, what its validation does not gate, and what its own counter gets wrong.
Deadlines Every date that matters in the Cyber Resilience Act, from entry into force to the reporting duty on 11 September 2026 and full obligations on 11 December 2027.
Where to report The coordinating CSIRT in all 27 member states, the Article 14(7) rule for working out which one is yours, and why choosing wrong can void a notification.
Fines Up to €15 million or 2.5% of turnover, whichever is higher, for the reporting duty. What the other two bands cover, and where small companies stand.
Statistics Every number in the Cyber Resilience Act, one quotable line each with its source: deadlines, fines, dates, product classes and KEV since 11 September.
Non-EU manufacturers If your company is outside the EU but you sell into it, the Cyber Resilience Act applies. Here is how to work out which national authority receives your report.
Readiness The Article 13 duties as 28 questions, which ones are blocking, the five documents a manufacturer needs and the Annex II user information per product.
Product classes Every important and critical product category in the Cyber Resilience Act, what each class means for conformity assessment, and why none changes a deadline.
Document outlines The vulnerability handling process, disclosure policy, SBOM policy, Annex VII documentation and Annex V declaration, outlined with the article for each.
SBOM requirements The Regulation asks for a machine-readable bill of materials covering at least the top-level dependencies. That is a smaller duty than most vendors assume.
Glossary The CRA vocabulary, defined once with the article each term rests on: the filings, the clocks, the classes, and the manufacturer duties around them.
CRA and NIS2 Both run a 24-hour and a 72-hour clock, and they bind different parties for different reasons. Reporting under one does not discharge the duty under the other.
This produces evidence, timelines and drafts. It is not legal advice, and you remain the party responsible for reporting.