The Article 14 early warning may need a list of Member States. It should name the States where the maker knows the product was offered. The main CSIRT will most often use this list when it shares the report with other CSIRTs.
This field needs a product sales record with proof. Do not make up a list in the first hours of an event.
Combine the distribution channels
Map direct sales, app or package stores, licences, markets, importers, sellers, and product bundles. For each source, record the product, versions, State, dates, data owner, and pull time.
The place of a party to the deal may not be where the product was offered. Do not use a bill address alone if sales records give a different answer.
Preserve source provenance
For each sales data pull, record the system, search rule, time, owner, dates, product IDs, and known gaps. Protect the raw proof. Link the State result back to it.
Match routes that may overlap. A direct sale and seller record may cover the same unit or right to use it. A repeat can skew a count even if this record only needs a proved State.
Mark a limit when a market or download route lacks sound place data. A global web page does not prove a Member State list by itself.
Express what is known
Give each State one of three states. Current proof may support it, rule it out, or leave it open. Give each open State an owner and next check. The early warning can then state what the maker knows without hiding gaps.
Save the exact proof used for the filing. If later sales records change the list, keep the old one. Add the fixed scope at the next report stage.
Require a reason for each change. It may be new sales data, a fixed product map, new version scope, or an error in the first pull. Keep the old state and the reviewer who approved the fix.
Keep product granularity
Do not use the firm’s full market map for each case. One product, release, or sales period may have a smaller or different State list. Link each State to the same main product IDs used in the report.
Test the process with a product sold in more than one way. Include a version sold by a middle party. The drill should show who can open the source records within the early-warning time.
Add a case with an unknown State. The filing person should state what the maker knows and save the gap. They should name its owner and continue the approved handoff. They must not invent a full map.
The result is a controlled State table. It supports both the maker’s claim and the authority route that follows.
Continue this workflow with the onward-dissemination map and the coordinating-CSIRT analysis.