Le compte à rebours de l'article 14 dans la CI (EN)
The clock already started Article 14 has applied since 11 September 2026. If a dependency I ship is actively exploited, I have 24 hours for an early warning and 72 hours for the full notification. The clock starts at a
The clock already started
Article 14 has applied since 11 September 2026. If a dependency I ship is actively exploited, I have 24 hours for an early warning and 72 hours for the full notification. The clock starts at awareness, not when a regulator writes to me.
Where I put the clock
I'm one developer. I don't have a team watching KEV feeds by hand, so the pipeline watches for me.
| Step | What runs |
|---|---|
| Scope | free test decides if I'm even a manufacturer |
| SBOM | SBOM built from the lockfile |
| Known vulns | vulnerability lookup on every dependency |
| Active exploitation | match against the CISA KEV catalogue |
| Gate | the pipeline fails on a KEV hit |
What a KEV hit means
A KEV hit is different from a CVE score: it means someone confirmed exploitation, with a date. That date is day one of my 24 hours.
Fines under Article 64 apply from 11 December 2027, so nothing here gets fined today. The duty to report still starts now.
I built the SBOM and the scan into https://crakit.eu/scan/?p=marketplace-20260923-devto, free, from your lockfile.
Not legal advice.
Louann Duclos · CRA Kit · https://crakit.eu?p=marketplace-20260923-devto
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.