ActLume

ActLume blog

Practical guidance for CRA Article 14 reporting.

Understand manufacturer readiness, incident coordination, deadlines, staged reports, and the human-controlled ENISA SRP handoff.

A shared two-stage reporting path branches to separate incident-and-clock and document-and-clock outcomes. Latest What must a manufacturer report under CRA Article 14, and when is each stage due?

CRA Article 14 reporting stages and deadlines

Both Article 14 tracks start with 24-hour and 72-hour stages, but their final-report clocks start from different events.

8 min read

Published articles

50 available Subscribe via RSS

  1. A square evidence ring holds one orange signal beside two fixed checkpoints. When does the CRA Article 14 reporting clock start for a manufacturer?

    When does the CRA Article 14 clock start?

    The CRA Article 14 clock starts when an initial assessment gives the manufacturer reasonable certainty that an actively exploited vulnerability or severe incident meets the reporting trigger.

    5 min read
  2. An orange intrusion path reaches one product core while three unconfirmed paths remain outside. What makes a vulnerability actively exploited for CRA Article 14 reporting?

    CRA actively exploited vulnerabilities explained

    An actively exploited vulnerability requires reliable evidence that a malicious actor exploited a vulnerability without the system owner's permission.

    3 min read
  3. Two distinct orange impact forms press against opposite sides of a green product core. How should a manufacturer test whether an incident is severe under CRA Article 14?

    The CRA severe product-security incident test

    Article 14 treats an incident as severe when it meets either of two product-security impact tests concerning protected data, functions, or malicious code.

    3 min read
  4. A compact orange information packet with a deadline clock sends one bounded alert from nested green fields. What should a manufacturer prepare for the CRA Article 14 24-hour early warning?

    What belongs in a CRA 24-hour early warning?

    The first Article 14 stage is an early warning due without undue delay and within 24 hours of awareness, not a finished investigation report.

    3 min read
  5. Six evidence tiles lock into a compact square dossier around an orange centre. What information belongs in the CRA 72-hour vulnerability notification?

    Prepare the CRA 72-hour vulnerability notification

    The 72-hour vulnerability stage adds available product, exploit, vulnerability, mitigation, user-action, and sensitivity information.

    3 min read
  6. A 72-hour information card, incident pulse, and checked mitigation shield sit inside a pale inspection lens. What should a manufacturer prepare for the CRA 72-hour severe-incident notification?

    Prepare the CRA 72-hour incident notification

    The 72-hour incident stage carries available general information, an initial assessment, and corrective or mitigating measures.

    3 min read
  7. Fourteen green segments close around a solid orange corrective block in a square composition. What starts the CRA deadline for an actively exploited vulnerability final report?

    When is the CRA vulnerability final report due?

    The final report for an actively exploited vulnerability is due no later than 14 days after a corrective or mitigating measure becomes available.

    3 min read
  8. A square orbit of evidence blocks surrounds an orange incident core and an open mitigation path. What starts the CRA final-report deadline for a severe product-security incident?

    When is the CRA severe-incident final report due?

    The final report for a severe incident is due within one month after the 72-hour incident notification.

    3 min read
  9. Two independent vertical lanes cross one shared orange intake line and finish at different points. Why should a manufacturer assess the two CRA Article 14 reporting tracks separately?

    The CRA has two Article 14 reporting tracks

    Article 14 separately covers actively exploited vulnerabilities and severe incidents affecting product security, with distinct final-report rules.

    3 min read
  10. Separate evidence fragments gather inside an open square frame. What should a manufacturer do when facts are incomplete at the CRA 24-hour reporting stage?

    What if CRA facts are incomplete at 24 hours?

    The CRA early warning comes before the fuller 72-hour notification, so teams need a controlled way to report known facts and preserve uncertainty.

    3 min read
  11. An orange thread loops through three separate green record tiles. How should a manufacturer maintain evidence across the stages of a CRA Article 14 report?

    Keep one evidence trail through CRA reporting

    CRA notifications develop across the 24-hour, 72-hour, and final stages, making a traceable record of additions and corrections essential.

    3 min read
  12. A square dark frame holds a compact awareness record with a clock face, evidence rows, and an orange seal. How should a manufacturer preserve and reconcile the timestamps behind a CRA awareness record?

    Record the CRA awareness timestamp

    A CRA awareness record needs more than one timestamp. Preserve raw source and receipt times, record clock quality, and explain how the chosen instant was normalised to UTC.

    6 min read