Awareness (start of the deadlines)
All three reporting deadlines run from "the manufacturer becoming aware". The Regulation does not say when that is, but the Commission guidance does: after an immediate initial assessment that gives a reasonable degree of certainty. The manufacturer has to record that moment itself.
Awareness is the moment from which the reporting deadlines under Article 14 run. It exists once the manufacturer, after an initial assessment, knows with a reasonable degree of certainty that a vulnerability in its product is being actively exploited or that a severe incident has occurred.
Definition in the Regulation
The Regulation does not define the term. Article 14(2) and (4) of Regulation (EU) 2024/2847 set the deadlines to run from "the manufacturer becoming aware of it". The Commission guidance C(2026) 5252 interprets this in paragraph 213: if the manufacturer detects a suspicious event, or a customer, an authority or a media organisation brings one to its attention, it should assess the event immediately. The manufacturer is to be regarded as having become aware when, after that initial assessment, it has a "reasonable degree of certainty" that the vulnerability in its product is being actively exploited or that a severe incident has compromised the security of the product. According to paragraph 212, this reading is deliberately aligned with NIS2 and the GDPR. Paragraph 217 rules out any retroactive effect: exploitation the manufacturer already knew about before 11 September 2026 does not have to be reported after the fact.
What it means for manufacturers
The clock does not start when a report arrives, nor only once the root cause analysis is complete, but somewhere in between. The initial assessment has to begin immediately; leaving it on the pile does not credibly postpone awareness. Leaving an e-mail unread offers only limited protection as well: the guidance aligns the concept with data protection law, where awareness delayed by poor organisation is moved back to the point at which it would have arisen in a properly run process. In its current release, ENISA's reporting platform records only the time of detection. The SRP glossary (as of 1 October 2026) lists a mandatory field for the time of awareness for incidents; for vulnerabilities it is announced for the next release. The platform's counter currently shows the 72-hour deadline as due 48 hours after the early warning is submitted (ENISA FAQ, as of 3 October 2026). Every manufacturer therefore needs its own log with four timestamps: first observation, completion of the initial assessment, internal escalation and submission. These timestamps later serve as evidence for market surveillance.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Early warning notification
- Actively exploited vulnerability
- Vulnerability notification (72-hour notification)
- Single reporting platform (SRP)