The CRA report chain gives each party a different task. Makers file the notices. ENISA runs the EU platform. Main CSIRTs get and assess the reports. They will most often share them with other CSIRTs at issue.

The in-house record should match these lines.

Manufacturer responsibilities

The maker owns the trigger test and each report stage. It also owns product scope, State scope, due times, and the truth of its data. It should keep proof of each choice and successful filing.

Platform and authority responsibilities

ENISA builds, runs, and keeps up the platform. The main CSIRT gets and checks the report. It handles later sharing under the CRA. Other CSIRTs get facts for their States.

Those tasks do not replace the maker’s work. The report team still needs an approved filing person and a settled CSIRT route. It also needs a sound list of States where the product was offered.

Name an owner for each key task. These include the trigger, awareness, clock, product scope, State scope, draft, approval, filing, and saved proof. In a small firm, one person may own many tasks. Each still needs a named backup.

Keep ownership apart from help. A vendor, lawyer, or service firm may give proof or draft aid. The maker should still save its own legal choice and approved words. It should name the person who filed and keep proof that the filing ended.

Set a handoff rule for each change of owner. The old owner gives the choice state, proof index, due time, open points, and next act. The new owner must accept the case. A note to a team chat is not a handoff by itself.

Keep the handoff evidence

Record which party should get the report and what the site said. If an authority later changes scope or asks a question, add it to the case trail. Name the reply owner and due time.

Keep an authority’s note apart from in-house approval. A question may reopen a code or legal check. It must not alter the filed copy with no trace. Save the request, reply owner, approved answer, result, and link to the first filing.

Test two cases. In one, the main filing person is away. In the other, teams clash on product scope. The due time must stay clear. The test must keep authority limits clear and pass changes through review. A read-only peer should be able to rebuild each handoff.

Continue this workflow with the platform-route overview and the access-continuity plan.