ActLume

ActLume blog

Practical guidance for CRA Article 14 reporting.

Understand manufacturer readiness, incident coordination, deadlines, staged reports, and the human-controlled ENISA SRP handoff.

Published articles

50 available Subscribe via RSS

  1. A small orange component is traced through three nested green product boundaries. When must a final-product manufacturer report an actively exploited vulnerability in a third-party component?

    When a component triggers CRA reporting

    A supplier's exploited flaw does not answer the final-product question; the manufacturer must establish whether its own product contains and is affected by it.

    3 min read
  2. An orange component packet moves across a bridged gap between two green blocks. What should a manufacturer do after identifying a vulnerability in a third-party component integrated into its product?

    Build the CRA handoff to a component maintainer

    The CRA requires manufacturers that identify an integrated-component vulnerability to report it upstream and address it in their own product.

    3 min read
  3. An orange component connects to selected cells in a large green version matrix. How should a manufacturer map a vulnerable component to affected product versions for CRA reporting?

    Map vulnerable components to CRA product versions

    CRA reporting needs product-specific information, so component evidence must resolve to shipped product versions rather than stop at a dependency name.

    3 min read
  4. An orange case marker anchors five distinct green identifier tabs in a square index. How should a manufacturer keep identifiers coherent across an Article 14 reporting case?

    Keep stable CRA case identifiers

    Use one internal case anchor to reconcile the manufacturer, product, affected versions, evidence, and staged Article 14 submissions.

    3 min read
  5. Selected orange markers sit across a grid of green territory tiles. How should a manufacturer determine which Member States to identify in a CRA early warning?

    Build the Member State record for a CRA warning

    The CRA early warning identifies, where applicable, Member States where the manufacturer knows the product was made available.

    3 min read
  6. Two orange evidence markers fall on opposite sides of a thick green boundary. How should a manufacturer prepare vulnerability-awareness records before Article 14 reporting starts?

    Prepare a pre-deadline exploitation baseline

    Article 14 reporting applies from 11 September 2026, so manufacturers need a dated baseline that separates earlier evidence from later awareness events.

    3 min read
  7. An orange product tile crosses an angled boundary toward four green market tiles. Do CRA Article 14 reporting obligations apply to manufacturers established outside the European Union?

    CRA reporting for manufacturers outside the EU

    Manufacturer location does not remove CRA reporting when an in-scope product is made available on the Union market.

    3 min read
  8. A green product tile passes through a square gate and emerges as an orange ownership tile. When does the CRA treat an importer or distributor as the manufacturer for reporting purposes?

    When CRA supply-chain firms become manufacturers

    An importer or distributor takes manufacturer obligations, including Articles 13 and 14, when it uses its own name or trademark or substantially modifies the product.

    3 min read
  9. An orange stewardship marker bridges a green code plane and a separate infrastructure ring. Which Article 14 reporting duties apply to an open-source software steward?

    CRA reporting duties for open-source stewards

    Article 24 links steward vulnerability reporting to development involvement and severe-incident reporting to development systems the steward provides.

    3 min read
  10. Three non-overlapping role frames compare an orange person marker, support ring, and product tile. Does maintaining an open-source project make a person an open-source software steward under the CRA?

    Is an open-source maintainer a CRA steward?

    A CRA open-source software steward is a legal person providing systematic, sustained support for specified software intended for commercial activities.

    3 min read
  11. Four uneven evidence tiles balance around a central orange decision point. How should a manufacturer resolve conflicting evidence about whether a vulnerability is actively exploited under the CRA?

    Resolve conflicting CRA exploitation signals

    A CRA active-exploitation decision turns on reliable evidence of malicious use without the system owner's permission, not on a label or score alone.

    3 min read
  12. One orange product square is isolated from a larger field of green incident tiles. How should a manufacturer decide whether an enterprise security incident is also a CRA severe incident affecting a product?

    Separate product security and enterprise incidents

    CRA severe-incident reporting concerns an incident that affects or can affect a product's ability to protect specified data or functions, or enables malicious code.

    3 min read