Article 14 reporting belongs to the manufacturer of the affected product. It does not belong to the team that first sees an alert.
That distinction can be hard inside a large group. The group may have many brands, subsidiaries, acquired products, and regional sellers. It may also use original equipment manufacturer (OEM) deals. The correct legal entity can be unclear when time matters most.
A manufacturer register resolves that issue before the reporting clock starts. It links each product to an evidence-based legal decision.
Begin with the market-facing product
Create one record for every product name seen in the market. Users, distributors, and authorities may use different names. Link those names in the same record.
Cover each product family and edition. Add white-label versions, firmware branches, and mobile apps. Add any component sold on its own. Also add remote processing that falls inside the assessed product boundary.
Record the commercial name and a controlled internal identifier. Record current versions and the displayed brand or trade mark. Note whether the product is on the Union market. Name the owners of each sales or delivery channel.
Keep retired and acquired products when they may still need a report.
Do not begin with the group chart. It shows corporate ownership. It may not show who meets the CRA manufacturer test for a given product.
Resolve the manufacturer with evidence
Record the person or legal entity that developed or made the product. The test also covers an entity that had the product designed, developed, or made. That entity must market the product under its name or trade mark.
Keep evidence for the conclusion. Useful records include the product label and user instructions. Keep declarations, earlier regulatory records, contracts, brand evidence, and release approvals too.
Test facts that may change the legal role. Check private-label sales first. Then check importer or distributor branding. Review any major change to the product. Check whether a third party offers a changed product.
Send disputed conclusions to counsel. State whether the issue affects one part or the whole product.
Mark each conclusion as approved, provisional, or disputed. A provisional entry must name the missing proof. It must also name the person who will obtain it. Do not present a guess as a settled fact.
Attach reporting operations
Give each manufacturer-product pair a clear decision owner and deputy. Link its coordinating CSIRT analysis. Name the people who may submit the report. Add the legal approver and security contact. Name the owner of user notices. Link the evidence location.
Shared services do not change legal accountability. A central security team may investigate for several manufacturers. It may also draft their reports. The register must still show who approves the statement for each legal entity.
Define the handoff for an event that affects products from several entities. Keep one technical event record. Open a separate legal decision and reporting route for each manufacturer when the facts support it.
Reconcile change events
Review the register after any acquisition or sale. Review it after a rebrand, a new sales model, or a product combination. Do the same after a major change, a new legal entity, or a new Union-market route.
Keep the date when each change took effect. Responders can then see who owned a version when it entered the market.
Run an exception report every quarter. Find products with no approved manufacturer or no deputy. Find disputed brands and old routing evidence. Treat each gap as a reporting-readiness risk.
Test the register with ambiguity
Test the register with a difficult case. Use a house-branded imported product, a changed integration, or an acquired old release.
Ask a responder to use only the register. They should find the manufacturer and affected versions. They should also find the decision authority, reporting route, and user-contact owner.
The register works when a real alert reaches one accountable legal decision quickly. The record must also explain why that entity owns the CRA report.
Continue this workflow with the role-changing manufacturer test and the responsibility chain.