After a manufacturer submits through the Single Reporting Platform, the coordinating CSIRT ordinarily disseminates the notification without delay to relevant coordinating CSIRTs in Member States where the product was made available.
That makes the manufacturer’s Member State information part of the routing record, not merely background context.
Build the availability map before a case
Maintain a product-level record of the Member States in which each product and relevant version was made available. Give the record an owner and provenance, such as distributor, direct-sales, licensing, or release evidence. Distinguish verified coverage from assumptions.
During an incident, freeze the source snapshot used for the submission. If the list changes as evidence develops, preserve the earlier value and the reason for the update.
Reconcile product scope with territory
Join the affected product and version set to the availability record. A product family sold in one Member State does not by itself establish that every affected version was made available there. Record the evidence resolution and any limitation rather than presenting an estimated market list as verified.
Give every territory a state such as verified, excluded with evidence, or unresolved. Assign unresolved entries to a commercial, distribution, licensing, or product owner and set the review time required by the reporting handoff.
Before approval, compare the Member State list with the manufacturer register and earlier reporting stage. Explain additions or removals. Preserve the exact list supplied in each filed snapshot so downstream routing can be reconstructed from the manufacturer’s input.
Do not confuse routing with publication
Onward dissemination is an authority-to-authority process under the CRA. It should not be described internally as public disclosure or customer notification. Those actions have different audiences, timing decisions, and content controls.
The reporting team should nevertheless coordinate them. A single case record can track regulatory routing, vulnerability handling, and user communications while keeping the purpose and recipient of each action distinct.
Prepare information for the routing chain
Classify sensitive material before submission and record the intended regulatory purpose. The manufacturer should provide the information required for the stage while identifying sensitivity through the applicable process, not remove useful facts merely because onward authority sharing may occur.
Keep four audience records separate: the coordinating CSIRT, other relevant CSIRTs, affected users, and any public communication. For each, retain the approved content, timing, decision owner, and delivery evidence. This prevents an internal note that a report was “shared” from concealing who actually received what.
If the availability map changes after filing, treat the change as a reviewed case event. Do not silently edit the old route record or assume that an internal update changed the external dissemination already performed.
Continue this workflow with the Member State availability record and the delayed-dissemination exception.