Apple TV now costs $14.99 a month in the United States, up from $12.99, and the yearly plan rose from $99 to $119. It is the fourth U.S. price rise since 2022 for a service that launched at $4.99 in 2019. Apple One’s cheapest bundle moved to $21.95 a month from $19.95.

TechCrunch first flagged the new rates on Friday morning. Variety said the U.S. change was effective immediately, and TVLine said the new rates apply Friday for new subscribers. Apple’s own TV storefront already listed $14.99 the same day.

The Annual Plan Took the Hardest Hit

The $2 monthly bump is the headline. The yearly jump is the one that changes the math. Last August, Apple lifted the monthly rate from $9.99 to $12.99 and left the yearly plan at $99, a discount that PCMag and TidBITS both treated as the way to dodge the hike. That freeze lasted one year.

THE NEW U.S. RATES

• Monthly plan: $12.99 to $14.99, a $2 rise of about 15%.
• Yearly plan: $99 to $119, a $20 rise of about 20%.
• Apple One Individual: $19.95 to $21.95, a $2 rise of about 10%.

Twelve months at $14.99 would cost $179.88. At $119 a year, the prepaid plan still comes out to about $9.92 a month, a saving of $60.88 if you stay the whole year. Last year’s $99 yearly rate saved $56.88 against $12.99 monthly billing, so the dollar saving is slightly larger and the percentage saving is slightly thinner. People who locked in $99 last fall to beat the $12.99 monthly rate now face a 20% jump at renewal.

Soccer, Formula 1, and the End of Season Pass

Apple is no longer selling a boutique originals app that happens to carry some games. The company now advertises live sports at no extra cost, naming Formula 1 races, MLS matches, and Friday Night Baseball on the same page as the $14.99 rate. That packaging is the bill behind the new price, not a memory-chip shortage.

MLS and Apple spent three seasons selling a separate Season Pass on top of Apple TV. Sports Business Journal reported that the 10-year rights pact that started in 2023 is worth $2.5 billion, about $250 million a year, and that from the 2026 season every regular-season match, Leagues Cup, All-Star Game, Campeones Cup, and playoff game sits inside a standard Apple TV plan. Season-ticket holders who used to get Season Pass now get a yearly Apple TV plan instead. Portland Timbers owner Merritt Paulson told SBJ he expects the league to “double our viewership” in 2026 because of that move.

Season Pass used to cost $14.99 a month or $99 a season on its own, or $12.99 a month and $79 a season for people who already paid for Apple TV. Folding that inventory into the base plan means the old upcharge is gone and the base plan is the one that rose.

WHAT NOW COMES WITH THE $14.99 PLAN

• Formula 1: Apple and Formula 1 announced a five-year U.S. pact in October 2025. Subscribers get practice, qualifying, Sprint sessions, and Grands Prix, and F1 TV Premium is included. Select races and all practice sessions stream free in the app. BBC Sport reported the deal is worth about $750 million, about $150 million a year, up from ESPN’s prior U.S. fee of about $80 million a year. Apple has not published its own dollar figure.
• Major League Soccer: Every club, no blackouts, plus studio shows, after Season Pass shut down as a standalone product.
• Friday Night Baseball: Regular-season doubleheaders on Fridays, still sold as part of the same plan rather than a separate pass.

Eddy Cue, Apple’s senior vice president of Services, tied the F1 deal to the subscription itself, not to a pay-per-view add-on.

We’re thrilled to expand our relationship with Formula 1 and offer Apple TV subscribers in the U.S. front-row access to one of the most exciting and fastest-growing sports on the planet.

Eddy Cue, senior vice president of Services, Apple Newsroom

The louder objection on Friday was not the $2. It was the catalog around those games. Apple’s originals still carry the reputation. The licensed movie shelf does not, and $14.99 makes that gap harder to ignore for anyone who is not watching soccer or Grand Prix weekends.

$4.99 Became $14.99 in Four Steps

Apple TV, then branded Apple TV+, launched on November 1, 2019, at $4.99 a month, or $49.99 a year per PCMag’s timeline. The first U.S. hike arrived three years later. Each later step has been shorter.

From $4.99 to $14.99 is a $10 rise, a 200% climb in under seven years. CableTV.com’s 2026 pricing guide put the inflation-adjusted launch price near $6.35 and noted the service had already outrun that line at $12.99. The new $14.99 rate widens that gap again. PCMag says Apple dropped the “+” from the name in October 2025, around the F1 announcement, which is when the product stopped presenting itself as a plus-one and started presenting itself as a full TV service.

Apple One Still Looks Like the Better Deal

Apple did not touch every bundle tier today. On July 17 it raised Apple Music’s Individual plan from $10.99 to $11.99 and Family from $16.99 to $19.99, and it lifted Apple One Family from $25.95 to $27.95 and Premier from $37.95 to $39.95. Individual Apple One stayed at $19.95 through that Music hike. Six weeks later, that protected tier is the one that moved with TV.

Apple now says the Individual plan is $21.95 per month, with Family still $27.95 and Premier still $39.95. Individual includes Music, TV, Arcade, and 50GB of iCloud+. Apple’s page claims a $13 monthly saving, or 31%, versus buying those parts apart. Family and Premier still advertise $17 and $35 in monthly savings.

The upsell gap is the quiet design choice. Apple One Individual now costs $6.96 more than standalone TV at $14.99. In July it cost $6.96 more than TV at $12.99. Apple raised both by $2 and left that gap exactly where it was, so the extra dollars for Music, Arcade, and 50GB of storage did not get more expensive relative to TV. The yearly TV plan, which is not inside Apple One, is the product that took the 20% hit.

People who already pay for Apple One felt less of Friday’s news, and that is the point of keeping the bundle gap flat. The stack still hides a TV hike better than a standalone bill does.

What $14.99 Buys Against Netflix and Peacock

At $14.99, Apple TV is still cheaper than Netflix’s $19.99 Standard plan and Peacock’s $19.99 ad-free Premium Plus, and it still runs without ads on Apple Originals. The gap is the library. Apple is selling originals plus live sports, not a deep back catalog, and Netflix remains the plan you buy when you want the shelf to be endless.

Netflix raised U.S. prices in March, taking Standard with ads to $8.99, Standard to $19.99, and Premium to $26.99. Peacock moved on August 18, its fourth hike in four years: Select to $8.99, Premium (with ads) to $12.99, and Premium Plus to $19.99. Disney+ Premium, last raised in October 2025, sits at $18.99. Apple now prices above Peacock’s ad tier and well below Netflix’s ad-free Standard tier.

Cord Cutter Weekly’s August 28 deals list still showed an Apple TV and Peacock Premium combo from $14.99, or $19.99 with ad-free Peacock. If that combo rate holds at $14.99, it now matches standalone Apple TV, which would make the Peacock add-on look almost free until NBCUniversal resets it. Treat that list price as a snapshot from Friday, not a promise it survives the Apple change.

Ampere Analysis, in a survey published by TV Tech this week, found that average price rises at Netflix, Disney+, and Amazon had slowed from 24% of the prior rate in 2023 and 2024 to 14% in 2025 and 2026. Apple’s monthly move sits near that newer average. Its yearly move does not.

Services Already Mint $30.7 Billion a Quarter

Apple can lift a streamer that still has a thin movie shelf because the streamer is not the business. For the fiscal third quarter ended June 27, Apple reported revenue of $109.4 billion, up 16%, and Services revenue of $30.7 billion, up 12% from $27.423 billion a year earlier. Services cost of sales was $7.494 billion, which is why that line still funds originals, soccer, and F1 without needing Netflix-like scale. “Today, Apple is proud to report our strongest June quarter ever, with double-digit revenue growth across iPhone, Mac and Services, and in every geographic segment,” said Tim Cook, Apple’s CEO, in the July 30 results release.

Hardware is getting less gentle in the same season. In June, Apple raised the Apple TV 4K streaming box from $129 to $199 for Wi-Fi and from $149 to $249 for Wi-Fi plus Ethernet, and it lifted HomePod and HomePod mini. “We have never seen a component price increase this much, this quickly,” Apple said then, pointing at memory and storage demand from AI data centers. This week the company is also selling the $899 Mac mini built for always-on AI into that same memory market. TechCrunch tied those parts shortages to Friday’s TV hike. The cleaner through-line is the one on Apple’s TV page: races, matches, and Friday doubleheaders now sit in the plan you already pay for, and $14.99 is what that plan costs.

Frequently Asked Questions

Does Apple TV still offer a free trial?

New customers still get a 7-day free trial, then $14.99 a month. If you buy an eligible iPhone, iPad, Mac, or Apple TV 4K and redeem the offer within 90 days, Apple includes three months of the service at no extra charge, which is the longer free window for anyone already buying hardware.

Can a family share one Apple TV plan?

Yes. Family Sharing covers up to six people on a single Apple TV plan, including the organizer, and they do not need to share a password. Apple TV and Arcade also keep Family Sharing even inside the Apple One Individual bundle, which otherwise does not share Music or iCloud+ the same way.

Do students get Apple TV for less?

The Apple Music Student Plan includes Apple TV at no extra cost after a one-month Music trial, so a qualifying student who already wants Music does not pay the $14.99 TV rate on top. That path is separate from Apple One and from the hardware promo.

Do you need an Apple TV 4K box to watch?

No. The Apple TV app runs on iPhone, iPad, many smart TVs, streaming sticks, game consoles, and at tv.apple.com, and Apple Originals can be downloaded for offline playback on Apple devices. The 4K box is optional hardware, and its own price rose in June, independent of the streaming plan.

Meta settled a 47-state teen-addiction case Wednesday for up to $17.1 billion and a two-hour daily cap on Instagram and Facebook. Judge Yvonne Gonzalez Rogers entered the consent judgment in Oakland, ending a trial that had opened on August 18.

The same paperwork holds back about $5.3 billion unless TikTok and YouTube take a tighter cap and pay. Meta’s first public line after the deal named those two companies.

The $5.3 Billion Pays Only If Rivals Fold

New York Attorney General Letitia James said the coalition locked in at least $12.1 billion to coalition states, with the figure rising to $17.1 billion if other major platforms reach similar deals. Meta’s newsroom used a wider tally of about $18 billion, of which participating states receive about $12.7 billion over 10 years, or roughly 70%.

The remaining 30%, about $5.3 billion on Meta’s math, is released only after two conditions. YouTube and TikTok must add a one-hour daily limit, a night mode, and age checks. Each must also pay an amount matching that 30% slice, with half of Meta’s leftover tied to YouTube’s check and half to TikTok’s.

CBS News reported that a Meta spokesperson described a separate Texas deal of about $1 billion that helps get the company to that $18 billion figure. Washington’s release does not list Texas in the $17.1 billion coalition. Florida is absent from both lists.

Meta will book about $10 billion in the third quarter for the agreement, a charge it said was not in the expense range from the July earnings call. For 2025, Meta reported revenue of $200.966 billion, operating income of $83.276 billion, and net income of $60.46 billion. The guaranteed decade of state payments is a single year of profit with change left over.

Two Hours a Day, With Exceptions Written In

California Attorney General Rob Bonta said the product terms are changes that take effect within months, not after another round of legislation. Parents can lift the defaults. Direct messages stay outside the clock.

The teen defaults Meta listed:

• Daily cap: Two hours across Facebook and Instagram, counted even if Meta detects multiple accounts, and off only with a parent’s permission.
• Night block: Midnight to 6 a.m., with no posting or viewing of Feed, Stories, Explore, or Reels.
• School mute: Push alerts off from 8 a.m. to 3 p.m., except direct messages and security or safety alerts.
• Scroll breaks: Prompts after every 15 minutes of continuous use, and again when daily use hits 60 and 90 minutes.
• Feed and likes: A non-algorithmic feed teens can choose, with parent power to make it the default, plus hidden like and reaction counts.
• Filters: A ban on extreme makeup filters, on top of the existing block on cosmetic surgery filters for teens.

If Snapchat, TikTok, and YouTube take comparable terms, Washington Attorney General Nick Brown said the daily cap on each Meta app drops to 60 minutes for 10 years. Meta’s own write-up matches that tighter clock and stretches night mode to 10 p.m. through 7 a.m. Until then, time limits and night mode start as a five-year promise. Most other terms run 10 years.

Bonta’s office also locked a report-handling rule the company newsroom did not headline: Meta must respond to 90% of teens’ harm reports within six hours. School-hour quiet time in that filing runs 8 a.m. to 3 p.m. from August 15 to June 15.

Zuckerberg Never Took the Stand in Oakland

The states had accused Meta of designing Facebook and Instagram to keep young users hooked, then misleading families about the risk, and of collecting data on children under 13 in violation of the Children’s Online Privacy Protection Act. Meta denied the claims in the judgment and still denies liability.

The path to Wednesday’s filing:

1. 2021: Attorneys general opened a joint investigation of how platforms were built and sold to children, Brown’s office said.
2. October 2023: James and 32 other attorneys general sued, alleging infinite scroll, constant alerts, and feeds that steered teens toward eating-disorder and self-harm posts.
3. August 18, 2026: Trial opened in Oakland with California, Colorado, Kentucky, and New Jersey as the live plaintiffs.
4. The first week: Arturo Béjar, a former Meta engineering director, testified that the apps were built to hold attention even when that hurt mental health.
5. August 26, 2026: The parties filed the deal; Gonzalez Rogers entered the consent judgment the same day, according to court papers.

Béjar told the court, “If you step away from the product, they are not going to make any money.” Wired reported that Instagram head Adam Mosseri was due back on the stand the morning the deal landed, and that the trial was not a quarter of the way through a planned 19-day run. Mark Zuckerberg did not testify.

Ars Technica reported that Meta had told the court some states’ damages theories ran above $1.4 trillion. The Atlantic put the states’ working trial figure near $200 billion. Ending in week two also ended the public reading of more internal research. An independent auditor will test Meta’s compliance each year for five years, and the deal sets up a research foundation that will receive consented user data.

California Is in Line for $2.1 Billion

Cash follows population and the 10-year calendar. James said New York will receive at least $819 million and up to $1.15 billion, money her office wants used for phone-free classroom grants, clinician training, after-school programs, and public-health work. Bonta said California will receive $1.5 billion to $2.1 billion, with the legislature and governor still to decide the split, though the filing earmarks it for preventing or repairing youth harm tied to social media.

Brown called the pact the largest state consumer protection settlement outside the 1990s Big Tobacco deals. Washington also takes an extra $10.2 million on a Cambridge Analytica resolution folded into the same papers. Georgia Attorney General Chris Carr said Meta was first to the table and should not be last.

The dollars move to state governments. Brown said his office will use a portion for attorney costs and consumer-protection work, plus programs on youth mental health. That is the part of the deal that reads like a fine to the public and like a budget line to the states. Individual teens who lost sleep do not get a check.

James Uthmeier, Florida’s attorney general, told CNET the state payouts are “peanuts” next to the harm, called the agreement “a slap on the wrist for a trillion-dollar corporation that has already paid more to its lawyers than it will pay the states,” and said Florida will see Meta at trial. New Mexico is also missing from the NY and Washington sign-on lists after a separate spring case. Meta’s own roster of 52 offices still omits both.

What Teens Can Still Open After Midnight

Night mode, the two-hour cap, and school mute do not apply to direct messaging, Meta said, so teens can keep talking to friends and family. Security and safety alerts also continue during school hours. The feed goes dark. The chat does not.

That hole is large if the harm the states described lives in group chats as much as in Reels. Parents who never turn on supervision tools will still see a two-hour clock and a midnight wall on the public surfaces, and a live message thread under both. Meta launched Teen Accounts in 2024 with tighter messaging and privacy defaults. Béjar’s point in Oakland was that engagement is the business, and former staff have argued those earlier switches did little.

Age checks are the other hinge. Meta said it will spend more on tools that catch under-13 accounts and that place 13-to-17 users into teen experiences even when they type an adult birthday. It also said app stores should pass verified ages to developers, a fight that sits with Apple, Google, and legislatures, not with this judgment. If a 14-year-old keeps an adult birthday, the two-hour cap never starts.

Meta’s Letter Names TikTok and YouTube

C.J. Mahoney, Meta’s chief legal officer, tied the whole bargain to companies that were not in the courtroom.

Our new Time Limit commitments, Night Mode features and usage limits during school hours set the right path forward for our whole industry, but this framework will only work if all our peers join us. Because teens move fluidly across dozens of apps, we need an industry-wide solution. We therefore call on our industry peers, TikTok and YouTube, to implement this new framework, right away.

C.J. Mahoney, Chief Legal Officer, Meta newsroom, August 26, 2026

The company posted an open letter aimed at TikTok and YouTube the same day and, Reuters reported, planned to run it in national newspapers on Thursday. HuffPost, citing New York Times reporter Mike Isaac, said the ad was slated for The New York Times, The Washington Post, and the Los Angeles Times. Reuters said TikTok and YouTube were not immediately available for comment, and a Meta spokesperson was “hopeful” Snap would move even though the letter does not name Snap. Washington’s term sheet does.

The ask is not symmetrical. Meta accepted two hours unless the others join. The others are being told to start at one hour, and to pay, before Meta’s leftover $5.3 billion moves. If they refuse, Meta keeps that slice and still sells the two-hour cap as the industry standard. James already has a separate suit against TikTok, which is the next obvious docket if this template is the point.

Bonta put the California version on the record Thursday morning.

https://x.com/RobBonta/status/2092831280790655115

Frequently Asked Questions

How much will Meta pay in the teen safety settlement?

James’s office set the coalition ceiling at $17.1 billion over 10 years, with $12.1 billion due even if no other platform settles; New York’s own band is $819 million to $1.15 billion, and she listed school phone-ban grants and clinician training as intended uses. Meta’s books use about $18 billion, a 70/30 split, and a $10 billion charge in the third quarter of 2026.

What daily time limit will Instagram and Facebook impose on teens?

The default is two hours a day combined, including extra accounts Meta detects, and a parent must approve any override. If Snapchat, TikTok, and YouTube take matching terms, that cap falls to 60 minutes on each Meta app and stays for 10 years instead of five.

Which states did not join the Meta settlement?

Florida’s attorney general rejected the money and said he will try the case; New Mexico is not on the sign-on lists released by New York and Washington after its own spring trial. Meta’s published list of 52 offices includes Texas and still leaves those two out.

How long will Meta’s new teen rules stay in force?

Most injunctive terms run 10 years. Time limits and night mode begin as a five-year commitment and extend to 10 years only if named peers sign on, which is also when night hours expand from midnight-6 a.m. to 10 p.m.-7 a.m. An independent auditor reports to the states each year for five years.

Do Meta’s night and time limits apply to direct messages?

No. Meta carved messaging out of Night Mode, the daily cap, and School Mode so teens can still reach friends and family, and school-hour muting still allows account-security and safety alerts. Public feeds, Stories, Explore, and Reels are what go dark after midnight.

Uthmeier still has a trial date. TikTok still has James’s complaint. Meta has a two-hour clock, a dark feed after midnight, and a $5.3 billion remainder that moves when those other apps blink.

Disclaimer: This article is news reporting on a court-approved settlement and related public statements, and it is for information only. It is not legal advice, medical advice, or guidance on any claim against Meta, TikTok, YouTube, Snap, or a state attorney general. Readers who think a child’s account, a pending case, or a health issue is at stake should talk to a licensed attorney or a qualified clinician before they act. Payment figures, product rules, and who has signed on reflect the cited filings and releases as of August 27, 2026, and can change if a court, a holdout state, or another company moves.

A 14 August scan of European software vendors found 374 of 492 reachable sites had no security.txt file. That is 76% of the live sample, two weeks before the EU’s 24-hour vulnerability clock starts.

The file is how a researcher is supposed to find a private inbox. When it is missing, the report tends to land on a national CSIRT desk, a public post, or a customer thread, and that is still awareness under the Cyber Resilience Act.

374 Reachable Vendors Still Have No Inbox

CRA Incident Drill, an independent research project, requested /.well-known/security.txt on 623 domains taken from the europealternatives.com directory of European SaaS and software companies. The check was a single GET, up to three redirects, with an eight-second timeout, on 14 August 2026.

A file counted as present only on HTTP 200 with a Contact line, which dropped SPA catch-alls that return 200 for every path. Unreachable names were left out of the percentages.

The authors publish aggregates, not the vendor list, because naming the dark domains would help attackers first. They also note that some firms take reports through bug-bounty platforms or a published security mailbox. The scan measures RFC 9116 adoption, not every possible inbox.

Article 14 Starts 15 Months Before a Contact Address

From 11 September 2026, makers of products with digital elements sold in the EU must report actively exploited flaws and severe incidents. The Commission’s CRA reporting page says they file an early warning within 24 hours of becoming aware, a fuller notice within 72 hours, and a final report later.

That duty is the first slice of Regulation (EU) 2024/2847 to apply. The Act entered into force on 10 December 2024. Most other rules, including Annex I’s essential cybersecurity requirements, apply from 11 December 2027.

Annex I Part II tells makers to enforce a coordinated disclosure policy and to provide a contact address for reports. That contact duty is 15 months after the 24-hour clock. Until then, the standard doorbell is still optional, while the legal timer is not.

When security vulnerabilities are discovered by researchers, proper reporting channels are often lacking. As a result, vulnerabilities may be left unreported.

RFC 9116, A File Format to Aid in Security Vulnerability Disclosure, IETF

Edwin Foudil and Yakov Shafranovich published that diagnosis in April 2022. The Commission’s own CRA summary adds that reporting covers products already on the Union market, including those placed there before 11 December 2027, which matches the Article 69(3) carve-out the scan cites.

THE REPORTING CALENDAR

1. April 2022: RFC 9116 defines security.txt as a known-location contact file.
2. 10 December 2024: The Cyber Resilience Act enters into force.
3. 11 June 2026: Chapter IV rules on notifying conformity assessment bodies apply.
4. 11 September 2026: Article 14’s 24-hour, 72-hour and final-report duties apply.
5. 11 December 2027: Annex I’s disclosure policy and contact-address duties apply with the rest of the product rules.

Awareness, not the birth of the flaw, starts the timer. A researcher who cannot find a private channel still creates that awareness when the note reaches a CERT, a journalist, or a customer.

Mail for 374 Vendors Lands on CSIRT Desks

National Computer Security Incident Response Teams already sit in the middle of this traffic. Under NIS2, member states must let people report flaws to a designated CSIRT, which then finds the vendor, helps the reporter, and negotiates disclosure when several parties are hit.

Article 14 now sends manufacturer filings to the same desks. A maker reports once through ENISA’s Single Reporting Platform. The notice goes to the CSIRT of the member state of the maker’s main establishment and, except in rare cases, to ENISA at the same time. That first CSIRT then shares the file with CSIRTs in other states where the product is sold.

ENISA’s August FAQ already tries to spare those teams extra work. Makers should register on the platform when they have a notice to file, it says, so CSIRTs are not asked to validate idle accounts. The same FAQ says CSIRT validation of a company’s representative happens after first access, in parallel with reporting, and should not block a filing.

The scan’s 374 silent vendors do not wait for that form. A researcher who cannot find Contact: still writes a national CSIRT because that is the path NIS2 already advertised. After 11 September the CSIRT may be both the first reader of the bug and the legal inbox for the company’s 24-hour warning.

Open-source stewards sit in a thinner version of the same duty, to the extent they are involved in products with digital elements. Voluntary reports of flaws, threats, incidents and near misses are due to open on the platform after the same date, which gives researchers a third door when the vendor has none.

Germany’s BSI Found the File on 1.8 Percent

Among European SaaS names the 24% hit rate looks poor as a CRA headline. Against the open web it is a high-water mark, and the CSIRT problem is still the 374 domains that sit below it.

On 6 August Germany’s Federal Office for Information Security said only 1.8 percent of German website operators publish the file, in measurements for its Cyberdome project. The agency told operators the effort is small and pointed to the 11 September reporting duties. The 2025 Web Almanac, using HTTP Archive data, put adoption at 1.82 percent of desktop websites and 1.72 percent of mobile sites, up from 1 percent in 2024.

About a quarter of those published files still fail a full RFC check because they omit a valid Expires date. Contact itself is almost universal when a file exists. The gap is getting the file onto the host, then watching the mailbox it names.

What a Researcher Does When Nobody Answers

RFC 9116 defines a machine-parsable vulnerability disclosure format at a single well-known path. The Contact field must always be present and must use a URI, such as mailto:security@example.com or an https form. Encryption keys belong at a URI, not pasted into the file. A policy field can point at the actual disclosure rules, which are a separate document from the doorbell.

A watched file is still a process. A published Contact that nobody reads is a decoy, and that is already how some long vendor chases go: a first note to the listed mailbox, a second from a corporate address, a LinkedIn ping to a CISO, then a national CERT, then a coordinator listing the vendor’s status as unknown months later.

THE USUAL ESCALATION

• First lookup: GET https://domain/.well-known/security.txt and use the Contact URI if it is there.
• Fallback hunt: security@, a /security page, or a bug-bounty form, which the scan does not count.
• Personal chase: a named security lead on LinkedIn when the mailbox is silent.
• Coordinator: a national CSIRT or CERT/CC, which is the NIS2 path and, after 11 September, a likely start of awareness.
• Voluntary SRP: a report of a flaw, threat, incident or near miss through ENISA’s platform once that door opens.

Each extra hop burns calendar time the 24-hour rule does not give back. If a CSIRT notice or a public write-up is the first thing the vendor cannot deny seeing, the early warning is already late, and it is already public.

ENISA Is Still Testing the Reporting Platform

Article 16 told ENISA to build a single electronic entry point so a maker files once. The Commission’s 23 August reporting page says functional and security testing are under way, and that the Single Reporting Platform will be live by 11 September 2026. ENISA’s FAQ, updated 3 August, says the same go-live and that a testing period is expected first.

WHAT WE KNOW

• Go-live: ENISA says the platform is scheduled to be operational by 11 September 2026, the day Article 14 applies.
• Login: company representatives will use an EU Login account; CSIRTs validate who may file for a given maker after first access.
• No API yet: large filers may script their own workflows, but ENISA will not offer application programming interfaces at this stage.
• Help desk: cra-srp-helpdesk@enisa.europa.eu is the contact published for questions the FAQ does not cover.

WHAT IS UNCONFIRMED

• Public URL: ENISA said the dedicated address would be posted on its SRP page before launch; that URL was not on the 3 August FAQ.
• Day-one load: whether CSIRT validation queues stay out of the way when many first filings arrive together is still an operational question.

A delayed-dissemination delegated act from December 2025 lets a CSIRT hold back sharing with other teams on cybersecurity grounds. That is a sharing brake, not a filing brake. ENISA also says the duty does not cover exploited flaws a maker already knew about before 11 September.

Fifteen days remain, and the 374 vendors without a standard inbox are still on the clock the moment a researcher, a customer, or a CSIRT makes them aware. CRA Incident Drill’s published curl loop is one request per domain; it still prints “missing” on three names out of four in that European list.

Frequently Asked Questions

What is a security.txt file?

It is a plain text file at https://example.com/.well-known/security.txt that tells researchers how to report a flaw. RFC 9116 requires a Contact field that uses a URI (mailto, tel, or https) and an Expires date; the 2025 Web Almanac found that about 25 percent of published files still omit a valid expiry and so are not fully valid even when Contact is present.

When do the Cyber Resilience Act’s Article 14 reporting rules start?

They apply from 11 September 2026, 21 months after the Act entered into force on 10 December 2024. Most other CRA duties, including Annex I’s essential cybersecurity requirements, apply from 11 December 2027, and Chapter IV on notifying conformity assessment bodies applied from 11 June 2026.

Does Article 14 apply to products already on the market?

Yes. The Commission’s CRA summary says reporting covers all products with digital elements made available on the Union market, including those placed there before 11 December 2027. ENISA’s FAQ adds that makers do not have to report exploited flaws they already knew about before the reporting rule itself applies.

Who receives an Article 14 notification?

The maker files once through ENISA’s Single Reporting Platform. The notice goes to the CSIRT of the member state of the maker’s main establishment and, except in rare cases, to ENISA at the same time, and that CSIRT then shares it with CSIRTs in other member states where the product is available. A December 2025 delegated act sets when a CSIRT may delay that extra sharing on cybersecurity grounds.

Is a security.txt file required on 11 September 2026?

No. Article 14 requires a report after the maker becomes aware of an actively exploited flaw or a severe incident. The Annex I duties to enforce a coordinated disclosure policy and to provide a contact address apply from 11 December 2027 with the rest of the product rules, so the file is still the lookup path researchers use, not the 11 September legal test.

Disclaimer: This article is news reporting and analysis of a published scan and of public EU and national guidance. It is informational only and is not legal advice, compliance advice, or a determination of whether any company is in or out of scope of the Cyber Resilience Act. Readers who need to design a disclosure policy, a reporting workflow, or a filing under Article 14 should consult a qualified EU product-security or regulatory lawyer, and where relevant their national CSIRT, before acting. Figures, platform status and legal dates reflect the sources as of 27 August 2026 and may change as ENISA’s Single Reporting Platform and Commission guidance are updated.