Skip to content
Declara
⌘K
compliance-owner

File an initial Article 14 report

Was this page helpful?

This page reflects our reading of Cyber Resilience Act, Article 14(2) as of . It is not legal advice. Review process.

You have 24 hours from the moment you became aware of an actively exploited vulnerability or severe incident to submit an early warning. This page gets you through it.

Before you start

  • You need a case. A vulnerability case opens when you triage an alert and press This is reportable — start the clock; that moment, or the earlier one you record there with a reason, is when you became aware. An incident case is opened from Cases → Record a severe incident. See Understand your first alert.
  • You need cases.submit permission to record the filing. Check your role on Invite a teammate and assign a role.
  • Someone who can log in to the reporting platform. See Prepare your reporting platform account; the case says what is missing until it is recorded.

Steps

  1. Open the case. The early warning is the stage on screen, with its 24-hour deadline.
  2. Fill in the early warning. Declara pre-fills what it already knows from the product, the workspace and the advisory, and marks those fields. Review each: pre-filled is not the same as correct. The form saves as you type.
  3. Press Generate packet. Copy each section, or Copy all, and Download PDF or Download JSON if you need a copy elsewhere.
  4. Press Open the reporting platform and copy the packet into the SRP web form yourself. Declara does not submit to the SRP — there is no SRP API today.
  5. Back in the case, enter the reference the platform gave you (it usually looks like SRP-DE-V-2026-00001751), or a note saying how else it was filed, and press Mark as submitted. If your workspace requires approval, a second member approves the packet first, or you record why it was filed without one.

What you should see

The case now shows early_warning_submitted and a new countdown for the 72-hour notification. The original 24-hour countdown disappears — it does not turn into a "late" indicator, because at this point you've already filed.

From now on, the timeline also shows Platform shows: the time the reporting platform displays for the notification, 48 hours after this filing. That counter is a known error on ENISA's side; the legal deadline is 72 hours from awareness. If the coordinating CSIRT later marks the filing valid or invalid, record it under the stage: see Track a filing.

Related