EU CRA Article 14: 24-Hour AI Disclosure Clock Starts Sep 11

Starting September 11, 2026, manufacturers of products with digital elements, including AI agents, must report actively exploited vulnerabilities. This new rule, EU CRA Article 14, requires a 24-hour early warning to ENISA SRP. What's interesting is this also includes MCP servers and inference endpoints used by crypto projects and DeFi platforms. Manufacturers then have 72 hours for a comprehensive notification and 14 days for a final report. This rule applies even to products placed on the market before December 11, 2027. The scope includes AI agents, which fall under the CRA’s definition of products with digital elements. There are also potential penalties up to 15 million Euros or 2.5% of global turnover. The bottom line is this materially increases security and compliance costs for crypto firms and token launches.