Since 11 September 2026, software manufacturers, MES vendors included, must send an early warning of an actively exploited vulnerability within 24 hours and a full notification within 72 hours to the CSIRT and ENISA. Who Article 14 of the CRA covers and what factories should ask of their vendor.