Final report
The final report completes the notification. For vulnerabilities, its deadline is tied not to awareness but to the fix: 14 days after an update or other mitigating measure becomes available. For incidents, it is one month after the 72-hour notification.
The final report is the third and last reporting stage under Article 14. It describes the vulnerability or incident, its severity and impact, the attackers where known, and the corrective measures taken.
Definition in the Regulation
Under Article 14(2)(c) of Regulation (EU) 2024/2847, the manufacturer submits the final report on an actively exploited vulnerability no later than 14 days after a corrective or mitigating measure is available. It contains a description of the vulnerability, including its severity and impact, information about the malicious actor where available, and details of the security update or other corrective measure. For a severe incident, Article 14(4)(c) applies. The final report is due within one month of the 72-hour incident notification and contains a description of the incident, its severity and impact, the type of threat or root cause, and the mitigation measures applied and ongoing.
What it means for manufacturers
The two deadlines run from different starting points. For vulnerabilities, the 14 days start when the fix becomes available, so the date of the fix must be recorded. On ENISA's reporting platform, the final report is a tab within the same notification; mandatory fields include the date the measure became available, details of the security update, measures for users and a full description of severity and impact. Once the final report has been submitted, the notification can no longer be edited, so a final report sent too early cannot be corrected. In parallel, from 11 December 2027 Annex I, Part II, point (4) requires manufacturers to publish information about the fixed vulnerability once the update is out.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Early warning notification
- Vulnerability notification (72-hour notification)
- Security update
- Security advisory