The Filing Is Not the Work

Editor’s note, October 2026: written on 2 September, nine days before Article 14 of the EU Cyber Resilience Act began to apply on 11 September. The sentences about that date now use the past tense; the dates are unchanged.

The filing is not the work. It is the notice that the work was owed.

On 11 September, Article 14 of the EU Cyber Resilience Act started to apply. Manufacturers of products with digital elements already on the market must report actively exploited vulnerabilities and severe incidents. An early warning within 24 hours of becoming aware, through ENISA’s Single Reporting Platform. A notification within 72 hours.

Most institutions reading this will meet the clock as operators of tools already in the estate, not as CRA manufacturers. The filing duty is still a useful calendar. The exam is the artifact behind it.

The Commission published application guidance on 27 July. Communication C(2026) 5252. It is non-binding. Authorities will treat it as the reference.

The rest of the CRA waits until 11 December 2027. Do not confuse the clocks. The Digital Omnibus deferred high-risk AI Act conformity. It did not delay this one. The AI Act’s Article 50 transparency duties applied on 2 August. Vulnerability reporting began on 11 September.

The industry treats 11 September as a filing problem. A platform, a CSIRT, a 24-hour timer. That work is real. It is not the exam.

Filing is a notice. A shared fix is not proof it landed. Someone has to run the estate, do the remediating work, and produce the artifact in the systems you already audit.

August produced exactly the event that clock was built for.

On 17 August GitLab shipped a critical patch. CVE-2026-19478. CVSS 9.4. Under certain conditions, an unauthenticated caller could modify or delete public projects and user data through a GraphQL directive. It is not remote code execution. GitLab.com and GitLab Dedicated were already running the patched version. Self-managed estates had to upgrade. Within about two days, researchers reported the same flaw being exploited in the wild. They reproduced it from the patch diff with AI in minutes.

That is the class. Active exploitation. A 24-hour clock that does not care whether your backlog is honest.

It was not a one-off. The same month, coding-agent and source-control tooling produced the adjacent incidents. An unauthenticated MCP sidecar in a widely used coding agent. GitHub Copilot and Visual Studio Code, CVE-2026-70335: an Important local elevation of privilege, user interaction required, not reported as exploited. Different flaws. Same shape. A known CVE. A shared tool the estate already runs. A patch that exists. And still no artifact that the remediating action was authorized, applied, tested, and held.

Finding is no longer the scarce resource. Capacity is. The capacity to apply the fix in this estate, under a named authority, and leave a record in the systems you already audit, against a named approval.

A ticket that says the work was assigned is not proof. A scanner that no longer lights up is not proof. An ENISA filing is not proof. An ordered record that this specific remediating action was authorized, applied to this version, tested, and held: that is an artifact. If an agent applied it, the record has to show the authority, and the point at which a human could have said no.

A promise to fix is a plan. What an examiner asks for is the record of the fix.

The Open Source Enterprise Resiliency Alliance, a FINOS initiative, helps regulated institutions close patch coverage gaps in the open source they run. A shared backpatch, when it ships into the versions you still run, is a shared fix. It is not the artifact that this estate applied it.

Canada does not need an AI Act analogue for this. OSFI’s July bulletin already brings generative and agentic AI under the sound practices in the guidelines you already run.

The operator seam

The remediating action has to live in the delivery process the institution already runs. A pull request in its own repository. A named person who merges, or does not. A stop that is reportable rather than hidden.

That is the operator seam. We run the platform, do the work, and prove it. Two decades of operating delivery tooling for regulated enterprises. GitLab is on that estate today. Named people. An agreed change process.

The thesis is the one the sector already knows. The fix is usually known. What runs out is the capacity to make it, review it, and evidence it.

The question a chief audit executive would ask

The executive sits down on a Friday and names one library.

You have been running it since 2019. The CVE has been public for three weeks. A patch exists. The scanner is quiet. The ticket is closed. Article 14, if it applies, has been filed.

Can you produce the artifact that the remediating action was authorized, applied, tested, and held?

Not after a week of reconstruction. Now, from the systems you already audit, against a named approval.

If nobody can say, the control has never been tested, and the first test will be the one an examiner runs.

Once a practice is written down, the third line asks about it. Article 14 made the filing a duty. The artifact behind the filing was always the exam.

That is the question a chief audit executive is already asking. The third line needs a population it did not have to assemble after the fact.

Sourcing and disclosure

Article 14 of the EU Cyber Resilience Act applies from 11 September 2026. Full CRA application date is 11 December 2027. EU AI Act Article 50 transparency requirements applied 2 August 2026. The Digital Omnibus Regulation deferred certain high-risk AI Act conformity requirements but did not defer Article 14 of the CRA.

This article takes no position on the legal interpretation of the EU Cyber Resilience Act, the EU AI Act, or any other regulation. Nothing here is legal advice.

iTmethods is a Silver Member of the Linux Foundation and a member of FINOS. We build runtime governance software for regulated enterprises. Our interest in the conclusion is not hidden.

Reign Factory is available today and contributes a pull request into the customer’s own path, where your reviewers approve every merge; Reign Ops holds a SOC 2 Type II attestation.