The 24-hour submission is an early warning. Article 14 requires it without undue delay and in any event within 24 hours after the manufacturer becomes aware of an actively exploited vulnerability or a severe incident affecting product security.
Do not turn the first stage into a demand for a completed root-cause analysis. The reporting sequence deliberately leaves room for a fuller 72-hour notification and a later final report.
Prepare the minimum reliable packet
The internal packet should establish which reporting track applies, identify the manufacturer and product, preserve the awareness time, and collect the information available for the early-warning fields. Mark unknown facts as unknown. Do not fill gaps with estimates presented as observations.
Maintain a product-availability record alongside the packet so the team does not have to start a fresh market search during the incident.
Draft from a fact ledger
Give each proposed statement a source, checked time, and state: verified observation, named third-party report, assessment, or unknown. The reporter should be able to remove unsupported prose without losing the underlying evidence. Do not turn an estimate into a fact by repeating it across drafts.
Keep the trigger analysis beside the packet but distinguish it from the external description. The decision record explains why the organisation treated the event as reportable. The early warning communicates the bounded information approved for the first stage.
Work backward from the limit
Set internal handoff times for technical review, legal review where required, approval, and submission. Make the incident manager responsible for the external limit, not merely for reminding other roles. If a review is late, escalate the unresolved point and the remaining time rather than waiting silently.
The deadline is an outside limit, not permission to wait until hour 24. A complete packet should not sit unsubmitted merely because the legal maximum is later.
Protect the handoff
Name the person authorised to review the packet and the person authorised to submit it. Keep a deputy for each role. The handoff should show what was approved, what remained uncertain, and when the filer took custody.
After submission, retain the submitted content and evidence of the result. Start the 72-hour work from the same case record so the later stage explains changes instead of contradicting an invisible earlier draft.
If an attempted submission does not produce reliable completion evidence, keep the clock open and escalate the failure through the approved contingency route. Preserve the attempt, error, person acting, and next action. Do not treat a local draft or an unverified click as proof that the warning was filed.
The first-stage record is sufficient when it states what is known, exposes what is unknown, identifies the approved reporting track and product, and leaves a clean handoff for the fuller notification.
Continue this workflow with the incomplete-facts workflow and the stage-handoff packet.