Launching managed CRA Article 14 reporting for open source maintainers
EU Cyber Resilience Act Article 14 reporting obligations begin, requiring 24-hour exploit and incident reports; Patchstack launches managed compliance for open-source maintainers.
Starting 11 September 2026, EU Cyber Resilience Act Article 14 requires manufacturers and open-source stewards to report actively exploited vulnerabilities and severe security incidents to ENISA via the EU Single Reporting Platform, with a 24-hour early warning, 72-hour notification, and final reports within 14 days or one month. Patchstack launched a free managed compliance service, acting as Assigned Representative for open-source maintainers and providing a managed VDP. The obligations apply retroactively to all products available on the European market. Patchstack, which has coordinated over 50% of known WordPress ecosystem vulnerabilities, already serves more than 1,000 open-source projects.
- Article 14 applies to all products, including those on the market before 11 September 2026
- Deadlines: 24-hour early warning, 72-hour notification, final report within 14 days or 1 month
- Open-source stewards cannot be fined but non-compliant products can be removed from the EU market
- Patchstack acts as Assigned Representative and provides single-channel mVDP and bug bounty
- EU Single Reporting Platform requires EU Login with MFA and has no API
- Vendors
- PatchstackENISA
- Countries
- EU
From the original article
4 min read at patchstack.com
Starting on 11 September 2026, the first obligations under the European Cyber Resilience Act will kick in – more specifically, Article 14. This mostly affects companies that make products with digital elements available on the European market, but it also applies to open-source software maintainers who, under the law, will be considered open-source stewards. Most […]
By Oliver Sild · patchstack.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.