Assess technical findings and report on time
Article 14 CRA reporting obligations have applied since 11 September 2026. Manufacturers need to distinguish actively exploited vulnerabilities from severe security incidents. A known vulnerability alone does not trigger the reporting obligation for active exploitation.
Test your reporting readinessTwo reporting triggers with different final deadlines
For both triggers, an early warning is required without undue delay and no later than 24 hours after becoming aware, followed by a notification within 72 hours. Both deadlines run from awareness; the 72-hour period does not start after the early warning.
For actively exploited vulnerabilities, the final report is due no later than 14 days after a corrective or mitigating measure becomes available. For severe incidents, it is due within one month of the 72-hour notification. Notifications are submitted through the CRA Single Reporting Platform to the relevant CSIRT coordinator and ENISA. Jurisdiction and access need to be established based on the relevant establishment.
A PSIRT needs clear decision paths
A Product Security Incident Response Team coordinates incoming reports, technical assessment, remediation and communication. A small team can work if cover arrangements, approvals and escalation are effective. Suppliers need to provide information in time for the manufacturer to act. Affected users must be informed as required by the CRA. Solvetronix also assesses regulatory reporting triggers and responsibilities.
What Solvetronix helps you establish
- Technical triage, product impact assessment and documented escalation criteria.
- Templates for findings, measures and technical input to notifications.
- A scenario exercise with manufacturer representatives and development partners.
Legal basis and sources
General information and technical guidance. The specific assessment depends on the product, role and use. Reviewed 22 October 2026.