Protect the CRA reporting window from the moment of awareness.

The reporting duty is already active.

The Cyber Resilience Act, or CRA, is the EU's product-security law for products with digital elements. Its Article 14 reporting duties began on 11 September 2026, ahead of most of the wider requirements in December 2027. UK location does not prevent a business from being the manufacturer when it places an in-scope product on the EU market under its own name or trade mark. European Commission reporting guidance.

The manufacturer must report actively exploited vulnerabilities and severe incidents affecting product security. An actively exploited vulnerability requires reliable evidence of malicious exploitation without the system owner's permission. A severe incident affects, or could affect, the product's protection of sensitive or important data or functions, including their availability, authenticity, integrity or confidentiality. An incident also qualifies when it causes, or could cause, malicious code to be introduced or executed in the product or a user's network and information systems. A newly discovered weakness or an ordinary equipment failure alone cannot establish either event. Product scope and the company's role also need to be checked. CRA definitions and Article 14.

Article 14 also reaches in-scope products placed on the market before 11 December 2027. The installed product population therefore belongs in the response plan alongside new releases. Product engineering and service teams need a way to connect a reported version to its affected EU markets. Commission implementation FAQ.

Record the first signal and the basis for awareness.

A service ticket may be the first signal. Technical assessment may then establish reliable exploitation evidence or the facts supporting a severe incident. Record both timestamps, with the evidence and the person making the assessment. Some signals already contain enough information to establish awareness on arrival.

The Commission's non-binding guidance describes awareness in terms of a reasonable degree of certainty after immediate assessment. That helps an operations team define the handoff, while the statutory duty remains anchored to awareness. A later management meeting, escalation email or signed approval supplies no replacement start time. Commission guidance linked from its reporting page.

The early warning is due without undue delay and within 24 hours of awareness. A fuller notification follows within 72 hours of awareness. For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure becomes available. For a severe incident, it is due within one month after submission of the 72-hour incident notification. Keep those event types separate in the record. ENISA reporting FAQ.

The 24 hours is an outer limit. The early warning needs the information required at that stage; waiting for a complete investigation can consume time needed to submit it. Continue containment and technical investigation while the reporting team works.

Begin the necessary work together.

An operations director should appoint one response owner with authority to bring the relevant teams together. Technical staff assess the event and preserve evidence. Product and service staff establish affected versions, EU availability and user populations. The legal or compliance lead checks the manufacturer, product and event conditions. The filing representative prepares the notification and confirms access to the reporting platform.

Start those activities when a plausible qualifying event needs immediate assessment. This recommendation preserves preparation time; it does not classify every signal as reportable. If an essential condition is positively absent, the response owner records that evidence and a monitoring trigger. If the condition is uncertain, assessment and filing preparation continue together until it is resolved.

Manufacturers file through the Single Reporting Platform operated by ENISA, the EU Agency for Cybersecurity. Keep the primary and backup filing representatives, their access and the appropriate coordinating authority ready before an incident. A reporting account problem during a live window belongs with the response owner immediately. The current platform guidance and manufacturer-specific authority rules determine the filing route.

Authority reporting also sits alongside communication to users. Article 14 requires the manufacturer to inform impacted users and, where appropriate, all users about the event and measures they can take. Assign that work to the customer or service lead, coordinated with technical and compliance staff. A platform submission receipt cannot close the user-communication action. CRA Article 14(8).

Measure the time left using the awareness record.

Use the calculation: remaining early-warning time equals 24 hours less the elapsed time since recorded awareness. It measures the response team's remaining window and supplies no test of legal reportability.

In this illustration, a manufacturer receives a signal at 09:00 on Monday 12 October. Immediate assessment establishes reliable malicious-exploitation evidence for an in-scope EU-market product at 10:30. At 16:30, six hours have elapsed since awareness and eighteen hours remain before the 24-hour outer limit. These are invented times and established scope assumptions.

A team that begins filing preparation at 10:30 has the same deadline as a team that waits for a 16:30 approval. The second team has spent six hours before starting that work. Appointing the filing owner and opening the product and market records earlier preserves those six hours for checking and submitting the warning.

Two further signals illustrate the routing boundary. Reliable evidence of malicious exploitation in another confirmed in-scope product follows the reporting route too. A separate equipment fault, positively established to have no relevant product-security impact and no exploited vulnerability, follows documented monitoring. An unexplained fault remains under immediate assessment; the absence of an answer cannot establish the monitoring condition.

For a severe incident, the response team records the evidence supporting that different event category and uses its corresponding final-report trigger. Changing the order in which these signals are reviewed changes neither their facts nor the route.

Keep one clock-control record through submission.

The response owner maintains this record while the technical investigation develops. Update it when new evidence changes scope or the affected population.

ENISA says its platform counters support visibility and reminders; manufacturers remain responsible for the statutory deadlines. Use the awareness record for the team's deadline control and resolve any discrepancy promptly against current official guidance.

Close each filing stage with its receipt and the next required action. Keep technical remediation, later reporting and affected-user communication assigned until their own completion evidence exists.