The Filing Is Not the Work

The Trust Layer. The artefact behind the claim. The operator thesis.

The filing is not the work. It is the notice that the work was owed.

Article 14 of the EU Cyber Resilience Act starts 11 September 2026. 24-hour early warning of actively exploited vulnerabilities. The industry will treat this as a filing problem.

On 11 September, Article 14 of the EU Cyber Resilience Act starts to apply. Manufacturers of products with digital elements already on the market must report actively exploited vulnerabilities and severe incidents. An early warning within 24 hours of becoming aware, through ENISA’s Single Reporting Platform. A notification within 72 hours.

Most institutions reading this will meet the clock as operators of tools already in the estate, not as CRA manufacturers. The filing duty is still a useful calendar. The exam is the artefact behind it.

The Commission published application guidance on 27 July. Communication C(2026) 5252. It is non-binding. Authorities will treat it as the reference.

The rest of the CRA waits until 11 December 2027. Do not confuse the clocks. The Digital Omnibus deferred high-risk AI Act conformity. It did not delay this one. Article 50 transparency duties applied on 2 August. Vulnerability reporting arrives on 11 September.

The industry will treat 11 September as a filing problem. A platform, a CSIRT, a 24-hour timer. That work is real. It is not the exam.

Filing is a notice. A shared fix is not proof it landed. Someone has to run the estate, do the remediating work, and produce the artefact in the systems you already audit.

August already wrote the class of event that clock was built for.

On 17 August GitLab shipped a critical patch. CVE-2026-19478. CVSS 9.4. Under certain conditions, an unauthenticated caller could modify or delete public projects and user data through a GraphQL directive. It is not remote code execution. GitLab.com and GitLab Dedicated were already running the patched version. Self-managed estates had to upgrade. Within about two days, researchers reported the same flaw being exploited in the wild. They reproduced it from the patch diff with AI in minutes.

That is the class. Active exploitation. A 24-hour clock that does not care whether your backlog is honest.

It was not a one-off. The same month, coding-agent and source-control tooling produced the adjacent incidents. An unauthenticated MCP sidecar in a widely used coding agent. GitHub Copilot and Visual Studio Code, CVE-2026-70335: an Important local elevation of privilege, user interaction required, not reported as exploited. Different flaws. Same shape. A known CVE. A shared tool the estate already runs. A patch that exists. And still no artefact that the remediating action was authorized, applied, tested, and held.

Finding is no longer the scarce resource. Capacity is. The capacity to apply the fix in this estate, under a named authority, and leave a record in the systems you already audit, against a named approval.

A ticket that says the work was assigned is not proof. A scanner that no longer lights up is not proof. An ENISA filing is not proof. An ordered record that this specific remediating action was authorized, applied to this version, tested, and held: that is an artefact. If an agent applied it, the record has to show the authority, and the point at which a human could have said no.

Ownership of a layer is a commercial arrangement. Proof of an action is an artefact. Only one of them is admissible.

FINOS announced the intent to form the Open Source Enterprise Resiliency Alliance in June. OSERA is still intent-to-form. A mutualized backpatch, if and when it ships into the versions you still run, is a shared fix. It is not the artefact that this estate applied it.

Canada does not need an AI Act analogue for this. OSFI’s July bulletin already treats generative and agentic AI as sound practices under the guidelines you already run.

The operator seam

The remediating action has to live in the delivery process the institution already runs. A merge request in its own repository. A named person who merges, or does not. A stop that is reportable rather than hidden.

That is the operator seam. We run the platform, do the work, and prove it. Twenty-one years of operating delivery tooling for regulated enterprises. GitLab is on that estate today. Named people. An agreed change process. A service that runs whether or not anything else on the register ever ships.

Reign Factory is Available · Beta Release. It is not generally available. It contributes a merge request into the customer’s own path. It does not merge. It does not release. It does not decide what ships. A named person holds the gate. A stop is a reportable outcome. GitLab today. Autonomy is off by default.

We publish the same construction on the other side of the claim. Reign Ops holds a SOC 2 Type II. That attestation does not extend to Factory, Gateway, or Assurance. We do not hold ISO 27001. We do not hold ISO 42001. We do not hold FedRAMP. We do not hold HIPAA. Naming a framework is not standing under it. Reign Assurance is co-design. It is not sold. It is not an audit opinion. Reign prepares. People decide.

The thesis is the one the sector already knows. The fix is usually known. What runs out is the capacity to make it, review it, and evidence it.

The question a CAE would ask

A chief audit executive sits down on a Friday and names one library.

You have been running it since 2019. The CVE has been public for three weeks. A patch exists. The scanner is quiet. The ticket is closed. Article 14, if it applies, has been filed.

Can you produce the artefact that the remediating action was authorized, applied, tested, and held?

Not whether you would eventually piece it together. Whether you can produce it. In the systems you already audit. Against a named approval.

If the honest answer is that nobody knows, the controls you have are describing a protection you have never tested. The difference only becomes visible when someone asks to see it, which is the worst possible moment to discover it.

Codified practices become questions the third line already asks. Article 14 made the filing a duty. The artefact behind the filing was always the exam.

That is the question a chief audit executive is already asking. The third line needs a population it did not have to assemble after the fact. For the Chief Audit Executive: https://itmethods.com/why/chief-audit-executive

Sourcing and disclosure

CVE-2026-19478 from GitLab security advisory 17 August 2026. Exploitation reporting via watchTowr and ISMG 19 August 2026. CVE-2026-70335 from Microsoft Security Response Center 11 August 2026. OSERA intent-to-form announcement by FINOS 26 June 2026. OSFI bulletin on generative and agentic AI 13 July 2026. European Commission Communication C(2026) 5252 on EU Cyber Resilience Act application guidance 27 July 2026.

Article 14 of the EU Cyber Resilience Act applies from 11 September 2026. Full CRA application date is 11 December 2027. Article 50 transparency requirements applied 2 August 2026. The Digital Omnibus Regulation deferred certain high-risk AI Act conformity requirements but did not defer Article 14 of the CRA.

This article takes no position on the legal interpretation of the EU Cyber Resilience Act, the EU AI Act, or any other regulation. Nothing here is legal advice.

iTmethods is a Silver Member of the Linux Foundation and a member of FINOS. We build runtime governance software for regulated enterprises. Our interest in the conclusion is not hidden. SOC 2 Type II attestation applies to Reign Ops only and does not extend to Reign Factory, Gateway, or Assurance. We do not hold ISO 27001, ISO 42001, FedRAMP, or HIPAA certifications.

Paul Goldman is the Founder and CEO of iTmethods, where his team builds the control and assurance layer for enterprise AI: the governance, evidence, and portability that let regulated institutions run any model, swap it under pressure, and prove control. He writes The Trust Layer at itmethods.com.