Definition

Awareness (becoming aware)

The moment the manufacturer has sufficient information to conclude that an exploited vulnerability or severe incident exists — the start of every Article 14 clock.

Article 14 deadlines run from the moment the manufacturer 'becomes aware' of the actively exploited vulnerability or severe incident. The regulation does not define the moment mechanically, so organisations should define it operationally in advance — for example, confirmation by the security lead that exploitation evidence is credible — and record the timestamp with its timezone and the person who confirmed it. Inferring awareness from when a ticket was created is a frequent and costly mistake, in both directions.

Reference: Art. 14(2) and 14(4) · Regulation (EU) 2024/2847 on EUR-Lex

Updated 2026-09-12 · Paraphrase for orientation, not legal advice.