The vulnerability-reporting obligation lands 11 Sep 2026 — three weeks away. Fines up to €15M or 2.5% of worldwide annual turnover. This page is the standing readiness record: what to report, how to evidence it, and how a signed measurement record helps you prove you were monitoring.
| Obligation | Detail | Penalty exposure |
|---|---|---|
| Report actively exploited vulnerabilities | ENISA early warning within 24h of awareness; notification within 72h; final report within 14 days | Up to €15M / 2.5% turnover |
| Report severe incidents | ENISA notification + affected-users notice per Art 14(3)-(4) | Up to €15M / 2.5% turnover |
| Maintain monitoring capability | Ongoing monitoring of vulnerabilities and incidents in the product | Evidenced by signed, timestamped records |
| Submit to certification (higher-risk categories) | Where the product falls in higher-risk categories | Per implementing acts |
EU CRA Art 14 · 2026-09-11 · UPCOMING · €15M/2.5% — live in /api/regulation.Regulators ask for behavioral records: decision logs, model version histories, monitoring windows — not assertions. A signed, hash-chained measurement record gives you a defensible, tamper-evident answer to "what was your system doing, and did you watch it?"
| Record | What it evidences | Status |
|---|---|---|
| Provision-conformance cards | Deterministic conformance to frozen provisions (e.g. Art 6 risk tier), 95% CI | MEASURED live |
| Model-version history | Which model version was in force, when, signed | MEASURED via cards |
| Corrections ledger | Appended-never-edited corrections — proof of credible neutrality | MEASURED public |
| Monitoring cadence | Quarterly re-verification, timestamped | MEASURED |
Not legal advice. Not a certification. Not a substitute for your own Art 14 reporting workflow. It is the evidence substrate — the signed, deterministic, replayable record that makes your reporting credible. We measure; we don't vouch.