Skip to main content

How do I file an Article 14 report?

Open the report, set its severity and classification, then use the Article 14 action to prepare the 24-hour early warning, the 72-hour notification, and the final report. CVD Portal prepares the package and records the filing. You submit it to ENISA through the Single Reporting Platform yourself.

Key takeaways​

  • Article 14 obligations apply from 11 September 2026 for an actively exploited vulnerability or a severe incident.
  • The controls sit on the submission, under severity and Article 14 obligations.
  • CVD Portal produces the SRP-ready package and records what you filed and when.
  • ENISA provides no submission API at this stage, so the submission itself is a manual step you complete on the SRP.
Silent walkthrough. Follow the numbered steps below for the full text.

Steps​

  1. Open Submissions and select the report.
  2. Set the CVSS Severity and mark the Report Classification as actively exploited where it applies.
  3. In Severity & Art.14 Obligations, open the Article 14 report.
  4. Complete the 24-hour early warning, then the 72-hour notification, then the final report as each becomes due.
  5. Submit the prepared package on the ENISA Single Reporting Platform, then record the SRP reference.

Last updated 17 September 2026.