The Filing Is Not the Work
The Trust Layer. The artefact behind the claim. The operator thesis.
The filing is not the work. It is the notice that the work was owed.
Article 14 of the EU Cyber Resilience Act starts 11 September 2026. 24-hour early warning of actively exploited vulnerabilities. The industry will treat this as a filing problem.
On 11 September, Article 14 of the EU Cyber Resilience Act starts to apply. Manufacturers of products with digital elements already on the market must report actively exploited vulnerabilities and severe incidents. An early warning within 24 hours of becoming aware, through ENISA’s Single Reporting Platform. A notification within 72 hours.
Most institutions reading this will meet the clock as operators of tools already in the estate, not as CRA manufacturers. The filing duty is still a useful calendar. The exam is the artefact behind it.
The Commission published application guidance on 27 July. Communication C(2026) 5252. It is non-binding. Authorities will treat it as the reference.
The rest of the CRA waits until 11 December 2027. Do not confuse the clocks. The Digital Omnibus deferred high-risk AI Act conformity. It did not delay this one. Article 50 transparency duties applied on 2 August. Vulnerability reporting arrives on 11 September.
The industry will treat 11 September as a filing problem. A platform, a CSIRT, a 24-hour timer. That work is real. It is not the exam.
Filing is a notice. A shared fix is not proof it landed. Someone has to run the estate, do the remediating work, and produce the artefact in the systems you already audit.
August already wrote the class of event that clock was built for.
On 17 August GitLab shipped a critical patch. CVE-2026-19478. CVSS 9.4. Under certain conditions, an unauthenticated caller could modify or delete public projects and user data through a GraphQL directive. It is not remote code execution. GitLab.com and GitLab Dedicated were already running the patched version. Self-managed estates had to upgrade. Within about two days, researchers reported the same flaw being exploited in the wild. They reproduced it from the patch diff with AI in minutes.
That is the class. Active exploitation. A 24-hour clock that does not care whether your backlog is honest.
It was not a one-off. The same month, coding-agent and source-control tooling produced the adjacent incidents. An unauthenticated MCP sidecar in a widely used coding agent. GitHub Copilot and Visual Studio Code, CVE-2026-70335: an Important local elevation of privilege, user interaction required, not reported as exploited. Different flaws. Same shape. A known CVE. A shared tool the estate already runs. A patch that exists. And still no artefact that the remediating action was authorized, applied, tested, and held.
Finding is no longer the scarce resource. Capacity is. The capacity to apply the fix in this estate, under a named authority, and leave a record in the systems you already audit, against a named approval.
A ticket that says the work was assigned is not proof. A scanner that no longer lights up is not proof. An ENISA filing is not proof. An ordered record that this specific remediating action was authorized, applied to this version, tested, and held: that is an artefact. If an agent applied it, the record has to show the authority, and the point at which a human could have said no.
Ownership of a layer is a commercial arrangement. Proof of an action is an artefact. Only one of them is admissible.
FINOS announced the intent to form the Open Source Enterprise Resiliency Alliance in June. OSERA is still intent-to-form. A mutualized backpatch, if and when it ships into the versions you still run, is a shared fix. It is not the artefact that this estate applied it.
Canada does not need an AI Act analogue for this. OSFI’s July bulletin already treats generative and agentic AI as sound practices under the guidelines you already run.
The operator seam
The remediating action has to live in the delivery process the institution already runs. A merge request in its own repository. A named person who merges, or does not. A stop that is reportable rather than hidden.
That is the operator seam. We run the platform, do the work, and prove it. Twenty-one years of operating delivery tooling for regulated enterprises. GitLab is on that estate today. Named people. An agreed change process. A service that runs whether or not anything else on the register ever ships.
Reign Factory is Available · Beta Release. It is not generally available. It contributes a merge request into the customer’s own path. It does not merge. It does not release. It does not decide what ships. A named person holds the gate. A stop is a reportable outcome. GitLab today. Autonomy is off by default.
We publish the same construction on the other side of the claim. Reign Ops holds a SOC 2 Type II. That attestation does not extend to Factory, Gateway, or Assurance. We do not hold ISO 27001. We do not hold ISO 42001. We do not hold FedRAMP. We do not hold HIPAA. Naming a framework is not standing under it. Reign Assurance is co-design. It is not sold. It is not an audit opinion. Reign prepares. People decide.
The thesis is the one the sector already knows. The fix is usually known. What runs out is the capacity to make it, review it, and evidence it.
The question a CAE would ask
A chief audit executive sits down on a Friday and names one library.
You have been running it since 2019. The CVE has been public for three weeks. A patch exists. The scanner is quiet. The ticket is closed. Article 14, if it applies, has been filed.
Can you produce the artefact that the remediating action was authorized, applied, tested, and held?
Not whether you would eventually piece it together. Whether you can produce it. In the systems you already audit. Against a named approval.
If the honest answer is that nobody knows, the controls you have are describing a protection you have never tested. The difference only becomes visible when someone asks to see it, which is the worst possible moment to discover it.
Codified practices become questions the third line already asks. Article 14 made the filing a duty. The artefact behind the filing was always the exam.
That is the question a chief audit executive is already asking. The third line needs a population it did not have to assemble after the fact. For the Chief Audit Executive
https://itmethods.com/why/chief-audit-executive
Sourcing and disclosure
Article 14 reporting obligations, and the 11 September 2026 start date, are taken from the Cyber Resilience Act and from the Commission’s application guidance, Communication C(2026) 5252, published 27 July 2026. Early warning within 24 hours via ENISA’s Single Reporting Platform, a notification within 72 hours, and a final report within 14 days (exploited vulnerability) or one month (severe incident) are the statutory cadence. The duties apply to in-scope products already on the market. Full CRA product obligations apply from 11 December 2027. Regulation (EU) 2026/1744, the Digital Omnibus on AI, deferred stand-alone Annex III high-risk obligations. It did not defer Article 50 transparency, which applied on 2 August 2026, and it did not defer CRA Article 14. Nothing here is legal advice.
CVE-2026-19478 is taken from GitLab’s 17 August 2026 patch release (19.2.4 / 19.1.6 / 19.0.8 / 18.11.11), CVSS 9.4, vendor language: under certain conditions an unauthenticated user could remotely modify or delete public projects and user data via a GraphQL directive. It is not unauthenticated remote code execution. GitLab.com and GitLab Dedicated were already patched. Exploitation in the wild within about two days, and AI reproduction from the patch diff in minutes, are reported by watchTowr as covered by ISMG / GovInfoSecurity on 19 August. CVE-2026-49471 (GHSA-37h2-6p4f-mp3q), patched in v1.5.2, is cited as the unauthenticated MCP sidecar class, not as a dunk on the project. CVE-2026-70335 is from Microsoft MSRC, 11 August 2026: Important elevation of privilege in GitHub Copilot and Visual Studio Code, local, user interaction required, not reported as exploited.
FINOS announced the intent to form OSERA on 26 June 2026. Rechecked 31 August against osera.finos.org. It remains intent-to-form. iTmethods is not an OSERA member.
OSFI published Generative and Agentic Artificial Intelligence: Implications for Technology, Cyber Security, and Operational Resilience as a technology-risk bulletin dated 13 July 2026, framed as sound practices under Guidelines B-13, E-21, and B-10. It is named as overlay, not as the hook.
Several parties described here build and sell in this market. So do we. iTmethods is a Silver Member of the Linux Foundation and a member of FINOS and the Agentic AI Foundation. We joined the foundations that are building the open layer. We are not an OSERA member. We are not an OSERA pilot. Our interest in the conclusion is not hidden.
The missing layer, as I read it, is runtime evidence of the remediating action. A shared fix is not the same object as proof that a specific action landed in a specific estate. That is editorial, not a claim that we consume anyone else’s artefacts or prove anyone else’s patches.
If the honest answer to the Friday question is that nobody knows, that is the conversation to have with your board and your audit committee before an examiner has it with you.
Paul Goldman is the Founder and CEO of iTmethods. His team runs the platform, does the work, and proves it. He writes The Trust Layer at itmethods.com.
Sources
European Commission, Commission publishes new guidance to support timely Cyber Resilience Act implementation, Communication C(2026) 5252, 27 July 2026
Jones Day, EU Cyber Resilience Act: 24-Hour Reporting Duties Start September 11, 2026, July 2026
GitLab Docs, Patch release GitLab 19.2.4, CVE-2026-19478, 17 August 2026
GovInfoSecurity / ISMG, GitLab Code Injection Flaw Exploited in the Wild, 19 August 2026
CVE-2026-49471 / GHSA-37h2-6p4f-mp3q (unauthenticated MCP sidecar class, patched v1.5.2)
Microsoft MSRC, CVE-2026-70335, 11 August 2026
FINOS, Intent to form OSERA, 26 June 2026
FINOS, OSERA
OSFI, Generative and Agentic Artificial Intelligence: Implications for Technology, Cyber Security, and Operational Resilience, technology-risk bulletin, 13 July 2026
iTmethods, Product status
iTmethods, Reign Factory (Available · Beta Release)
iTmethods, For the Chief Audit Executive