CRA Article 14 reporting: turn 24h and 72h deadlines into a runbook
Name a reporting owner and deputy before an incident. Record when the organisation becomes aware, prepare the early-warning and notification information, and test access to the official reporting platform.
Know which clock you are running
For manufacturers, Article 14 covers actively exploited vulnerabilities and severe incidents affecting product security. It is not a requirement to notify every vulnerability found by a scanner. The obligations have applied since 11 September 2026.
| Stage | Deadline |
|---|---|
| Early warning | Without undue delay, and within 24 hours of awareness. |
| Notification | Without undue delay, and within 72 hours of awareness. |
| Final vulnerability report | No later than 14 days after a corrective measure becomes available. |
| Final severe-incident report | Within one month after the 72-hour notification. |
Prepare the submission route
The CRA Single Reporting Platform, operated by ENISA, is the official submission route. Use ENISA’s current registration and notification guidance to confirm the appropriate CSIRT and account roles for your organisation.
In the runbook, record who maintains access, who can submit and who acts as deputy. Store access instructions in an approved internal system, not in a public policy or downloadable template.
Minimum operational record
- Product and affected versions, with the responsible product owner.
- The awareness timestamp, time zone and evidence behind that decision.
- Current assessment of exploitation or incident severity, with uncertainties.
- The reporting decision owner, reviewer and named deputy.
- Information needed for the initial submission, with missing facts tracked separately.
- Submission acknowledgement and a schedule for updates and the final report.
Rehearse the handoff
Run a tabletop scenario before you need the process. Start with a plausible customer report arriving outside office hours. Ask the team to identify the product, reach the decision owner and locate the submission account.
Time the handoffs. Record where the exercise stops: an inaccessible inbox, an absent deputy, uncertain product versions or a supplier who cannot provide information. Assign those gaps as engineering or operating tasks. Do not send a fictional incident to the live authority platform.
Keep reporting and remediation connected
A reporting runbook should link to the remediation issue and customer communication plan. Update the record as facts change and preserve the history of decisions.
Dotgrey Continent prepares the workflow and supporting evidence with your team. The manufacturer retains responsibility for its reporting and conformity obligations. Confirm difficult classification and legal questions with qualified counsel.
Official sources and references
- European Commission — reporting obligations
- ENISA — Single Reporting Platform
- Regulation (EU) 2024/2847
The suggested workflows are Dotgrey engineering recommendations. Official texts determine obligations; applicability must be checked for each product.