After a maker files on the EU platform, the main CSIRT will most often share the report without delay. It sends the report to other main CSIRTs where the product was offered.
The maker’s list of Member States is thus part of the route. It is not just background.
Build the availability map before a case
Keep a list of States where each product and key version was offered. Give the list an owner and proof source. The source may be a seller, direct sale, licence, or release record. Keep checked facts apart from guesses.
During an event, save the exact source list used for the report. If new proof changes the list, keep the old value and the reason for the change.
Reconcile product scope with territory
Join the affected product and version list to the State list. A product family sold in one State does not prove that each weak version was offered there. Record how exact the proof is and where it falls short. Do not label an estimate as checked.
Mark each State as checked, ruled out with proof, or not yet clear. Give open entries to the right sales, licence, product, or seller owner. Set a due time that fits the report handoff.
Before approval, compare the State list with the maker list and last report stage. Explain each added or removed State. Save the exact list sent at each stage. A reviewer can then rebuild the route from the maker’s data.
Do not confuse routing with publication
Later sharing is from one authority to another under the CRA. It is not a public post or a user note. Those acts have different readers, times, and content rules.
The report team should still plan them as one case. One record can track the legal route, flaw work, and user notes. Keep the goal and reader of each act clear.
Prepare information for the routing chain
Mark secret facts before filing and note why an authority needs them. Give the facts needed for the report stage. Use the set process to mark them as sensitive. Do not remove useful facts just because other authorities may see them.
Keep four reader records apart. They cover the main CSIRT, other CSIRTs, users at risk, and the public. For each, save the approved words, time, owner, and proof of delivery. A vague note that facts were “shared” should not hide who got what.
If the State map changes after filing, treat it as a new case event. Do not edit the old route with no trace. An in-house change does not alter outside sharing already done.
Continue this workflow with the Member State availability record and the delayed-dissemination exception.