ActLume

ActLume blog

Practical guidance for CRA Article 14 reporting.

Understand manufacturer readiness, incident coordination, deadlines, staged reports, and the human-controlled ENISA SRP handoff.

Published articles

50 available Subscribe via RSS

  1. Four green relay nodes circle an orange signal with one open backup path. How should a manufacturer design an after-hours escalation chain for CRA Article 14 reporting?

    Build an after-hours CRA escalation chain

    CRA early warnings and notifications use hour-based deadlines from awareness, so reporting ownership needs tested backups outside normal schedules.

    3 min read
  2. An orange evidence marker rests below two completed green decision gates. How should a manufacturer document a decision that a product-security case is not reportable under CRA Article 14?

    How to document a CRA decision not to report

    A non-report decision should show how the evidence was tested separately against the CRA definitions for active exploitation and severe incidents.

    3 min read
  3. An orange entry reaches a central green platform surrounded by routed endpoints. How does the CRA Single Reporting Platform route a manufacturer's Article 14 notification?

    How the CRA Single Reporting Platform works

    The CRA platform gives manufacturers one electronic entry point that routes a notification to the coordinating CSIRT and ENISA.

    3 min read
  4. Five distinct stations form a green arc around one orange submission tile. What are the responsibilities of the manufacturer, ENISA, and coordinating CSIRT in CRA reporting?

    Who does what in the CRA reporting chain?

    Manufacturers submit; ENISA manages the platform; coordinating CSIRTs receive, assess, and ordinarily disseminate Article 14 notifications.

    3 min read
  5. One orange decision centre selects a single path among four green locations. How does an EU-established manufacturer choose the coordinating CSIRT for CRA Article 14 reporting?

    How to choose the CRA coordinating CSIRT

    For an EU-established manufacturer, the CRA starts with the Member State where product-cybersecurity decisions are predominantly taken.

    3 min read
  6. An orange source tile sends separate lines to five green destination tiles. Where does a CRA Article 14 notification go after a manufacturer submits it?

    Where a CRA report goes after submission

    The coordinating CSIRT ordinarily shares a CRA notification with relevant CSIRTs where the affected product was made available.

    3 min read
  7. An orange control gate holds a green signal inside a protected circular route. When can onward dissemination of a CRA Article 14 notification be delayed?

    CRA delayed dissemination is an exceptional route

    A coordinating CSIRT may delay onward dissemination only under the CRA's exceptional, justified cybersecurity conditions and for a strictly necessary period.

    3 min read
  8. Four offset green gates lead an orange signal toward one central destination. Which coordinating CSIRT should a manufacturer without an EU main establishment use for CRA reporting?

    How CRA reporting routes non-EU manufacturers

    A manufacturer with no EU main establishment follows an ordered CRA routing test based on its representative, importer, distributor, then users.

    3 min read
  9. An orange access tile and green backup tile sit inside a circular protected gateway. How should a manufacturer prepare internal reporting continuity before an Article 14 clock begins?

    Build continuity for CRA reporting access

    Prepare an internal primary-and-backup submission path around the CRA's staged reporting deadlines without relying on unverified platform mechanics.

    3 min read
  10. A single orange card enters a green split route ending at two equal nodes. Must a manufacturer file separate CRA notifications with ENISA and its coordinating CSIRT?

    A CRA report is one submission, not two filings

    Manufacturers submit once through the CRA platform, which routes the notification to the coordinating CSIRT and makes it available to ENISA.

    3 min read
  11. Three selected green user nodes receive an orange signal inside a larger circular audience. When and to whom must a manufacturer send a CRA user notification?

    When the CRA requires an impacted-user notice

    After awareness of an actively exploited vulnerability or severe product-security incident, the manufacturer must inform impacted users and sometimes all users.

    3 min read
  12. Three large green action blocks sit beneath an orange notice marker in a square layout. What content should a manufacturer include in a CRA user notice?

    What a useful CRA user notice needs to say

    A CRA user notice should identify the affected product and give deployable mitigation or corrective steps where those measures are necessary.

    3 min read