A scanner marks a vulnerability critical. Does that mean you need to notify under the CRA? The score alone cannot answer that. You need the affected product, evidence of exploitation or a qualifying severe incident, and the time the manufacturer became aware. Put those facts into one case before the team starts arguing over the deadline.
Finish this job
Record a reporting route before the clock expires
- 1Identify the affected product and version.
- 2Assess the current facts against the reporting route.
- 3Record the decision, owner, deadlines and evidence.
Check the trigger, not just the severity score
Article 14 reporting applies from 11 September 2026. Under Article 3(42), active exploitation requires reliable evidence of malicious use of the vulnerability in a system without its owner’s permission. A high severity score or a researcher’s proof of concept does not, on its own, establish that trigger.
For example, a lab demonstration of a flaw and credible evidence of an attacker exploiting that flaw on a customer’s device are different inputs. Record which evidence you have. If active exploitation is not established, still assess whether a severe incident exists under Article 14(5); do not let one negative answer close the entire review.
The severe-incident test includes impacts, or potential impacts, on the protection of sensitive or important data or functions. It can also be triggered by actual or potential introduction or execution of malicious code. Record how the facts meet or fail Article 14(5) rather than relying on the word “severe” in a ticket label.
Sources: Regulation (EU) 2024/2847 — official text·European Commission — CRA reporting obligations
Check reporting duties for products sold before 11 December 2027.
Open one case for the signal
Start with the affected product, release or version and the event being assessed. Link the original signal instead of copying fragments into several tickets. The case should carry the chronology from the first alert through the reporting decision and corrective action.
This matters because the CRA reporting duties concern actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements. Those routes require different facts, but both depend on a clear product and event record.
Record the awareness time and why it was chosen
An early warning is due without undue delay and, in any event, within 24 hours of awareness. Unless the information has already been supplied, a fuller notification follows within 72 hours.
Teams may have several candidate timestamps: the first customer report, an automated alert, technical confirmation or escalation to security. Preserve the events and record which one the team treated as awareness, who made that call and what evidence supported it.
- Internal approval does not reset or postpone the manufacturer’s awareness. Escalate uncertainty promptly and retain the earlier events instead of choosing the most convenient timestamp.
Give the assessment the facts it needs
Before choosing a reporting route, make these inputs available in the case:
- The affected product, versions and markets.
- What is known about exploitation and the security impact.
- The source and confidence of each material fact.
- Corrective or mitigating measures already available.
- The person who owns the reporting decision.
Record the route, then keep the reporting work open
Record each applicable route: actively exploited vulnerability, severe incident, both if the facts trigger both, or no current mandatory Article 14 route established. Keep the reason and the interpretation used beside the answer. An unresolved fact needs an owner and a reassessment point, not an unexplained “no”.
The final-report timing then depends on the route. Unless the relevant information has already been provided, the vulnerability final report is due no later than 14 days after a corrective or mitigating measure becomes available. The severe-incident final report is due within one month after the incident notification.
Keep preparation, submission and follow-up tasks open until they are actually complete. Article 14(8) also requires information for impacted users, and where appropriate all users, including measures they can take where necessary. A completed CRA Operations assessment records a decision; it does not send a report to ENISA or notify your users.
Sources: Regulation (EU) 2024/2847 — official text
Rehearse this handoff with the 45-minute reporting drill.
Keep the reporting decision in a case file that another reviewer can reconstruct.
Put the guidance into practice
Compare specific facts, worked assessment results and evidence to retain.
This article explains an operational approach to CRA preparation. It does not replace the Regulation, official guidance or advice for a specific product and organisation.
Not lawyer-reviewed.