ActLume

ActLume blog

Practical guidance for CRA Article 14 reporting.

Understand manufacturer readiness, incident coordination, deadlines, staged reports, and the human-controlled ENISA SRP handoff.

Published articles

50 available Subscribe via RSS

  1. Four green product tiles resolve to one selected orange manufacturer record. How should a product group identify the legal manufacturer that owns each CRA Article 14 decision?

    Build a manufacturer register for CRA reporting

    CRA Article 14 duties attach to the manufacturer of the affected product, so a reporting runbook needs a product-specific legal-entity map.

    4 min read
  2. One orange packet advances through three stacked green stage frames. What evidence should move between the early warning, 72-hour notification, and final CRA report?

    Build a handoff packet for each CRA report stage

    Preserve the approved facts, unresolved questions, and filing evidence at the early-warning, 72-hour, and final Article 14 stages.

    3 min read
  3. An orange sensitive field sits among separately classified green report strips. How should a manufacturer classify sensitive information in a CRA notification?

    Classify CRA report sensitivity before submission

    CRA 72-hour notifications indicate, where applicable, how sensitive the manufacturer considers the reported information to be.

    3 min read
  4. An orange event tile feeds two separated green decision rings. How should an organisation assess the same security event under both the CRA and NIS2?

    Triage one event under both the CRA and NIS2

    The same security event can require separate assessment under the CRA's product-manufacturer test and NIS2 rules applying to an affected entity.

    3 min read
  5. An orange incident marker sits inside two offset green assessment frames. How should a manufacturer assess one event that may be both a CRA product incident and a GDPR personal data breach?

    Triage a product incident under the CRA and GDPR

    A security event may require both a CRA product-security assessment and a GDPR personal-data-breach assessment because the regimes ask different questions.

    4 min read
  6. An orange optional signal branches beside a firm green reporting path. When should a manufacturer or another person consider a voluntary CRA notification?

    Decide when to use CRA voluntary reporting

    CRA Article 15 permits voluntary notification of vulnerabilities, cyber threats, incidents, and near misses beyond the narrower mandatory Article 14 triggers.

    3 min read
  7. An orange notice reaches selected green recipient nodes within a square delivery map. How should a manufacturer choose channels and prove that a CRA user notice reached the intended audience?

    Prove delivery of a CRA user notice

    CRA user communication is risk-based: manufacturers inform impacted users and, where appropriate, all users without implying that every case requires indiscriminate public disclosure.

    3 min read
  8. Three staggered planning cards give conformity, live reporting, and product duties their own orange calendar gates. What must a manufacturer separate when planning for the CRA's 2026 and 2027 application dates?

    Separate the CRA's 2026 and 2027 workstreams

    CRA conformity-body provisions apply from 11 June 2026, Article 14 reporting from 11 September 2026, and most remaining provisions from 11 December 2027.

    3 min read
  9. Several aged green product tiles align with one orange triage marker. How should a manufacturer prepare older products for CRA Article 14 reporting?

    Bring legacy products into CRA reporting triage

    CRA Article 14 reporting applies to in-scope products made available before 11 December 2027, not only to products launched after the main application date.

    3 min read
  10. An orange timestamp punch opens a bounded green interval on a straight evidence rail. What should a manufacturer record as the moment a corrective or mitigating measure becomes available for CRA reporting?

    Record when a CRA corrective measure is available

    For an actively exploited vulnerability, the CRA final report is due no later than 14 days after a corrective or mitigating measure becomes available.

    3 min read
  11. A small orange tile passes a green clock while a separate shield covers only one segment. Does the CRA exempt a microenterprise or small enterprise from the 24-hour early-warning duty?

    CRA small-business relief does not waive deadlines

    CRA Article 64 prevents fines for certain micro and small manufacturers that miss the 24-hour early-warning deadline, but it does not remove Article 14 reporting duties.

    3 min read
  12. An orange question tile aligns with three green support-response blocks. What should a smaller manufacturer prepare before asking a CRA reporting helpdesk for support?

    Ask a CRA reporting helpdesk a useful question

    The CRA requires coordinating CSIRTs to provide helpdesk support for reporting, with particular attention to microenterprises and small and medium-sized enterprises.

    3 min read