Article 14 reporting ownership follows the manufacturer of the affected product, not whichever team first receives a security alert. In a group with multiple brands, subsidiaries, acquired products, OEM arrangements, and regional sellers, that legal entity may be unclear at exactly the wrong moment.
A manufacturer register makes the decision product-specific and evidence-based before the reporting clock is in play.
Begin with the market-facing product
Create one record for every product name users, distributors, and authorities can encounter. Include families, editions, white-label variants, firmware branches, mobile applications, separately marketed components, and remote data-processing functions included within the product boundary as legally assessed.
Capture the commercial name, controlled internal identifier, current versions, brand or trademark displayed, Union-market status, and channel owners. Keep retired and acquired products visible if they remain relevant to reporting.
Do not start with the corporate organisation chart. It describes ownership relationships, not necessarily who meets the CRA manufacturer definition for a particular market offering.
Resolve the manufacturer with evidence
Record the natural or legal person that developed or manufactured the product, or had it designed, developed, or manufactured, and markets it under its name or trademark. Preserve the supporting product label, user instructions, declaration or pre-existing regulatory record, contracts, brand evidence, and release approval.
Test role-changing facts separately. Identify private-label sales, importer or distributor branding, substantial modifications, and third parties making modified products available. Route contested conclusions to counsel and note the part or whole-product scope where relevant.
Give every conclusion a status: approved, provisional, or disputed. A provisional record should name the missing evidence and an owner rather than presenting a guess as settled.
Attach reporting operations
For each manufacturer-product pair, assign the Article 14 decision owner, deputy, coordinating-CSIRT analysis, assigned submission representatives, legal approver, security contact, user-communication owner, and evidence location.
Map shared services without confusing them with accountability. A central product-security team may investigate and draft for several manufacturers, but the register should show who authorises the statement for each legal entity.
Define the handoff when one event crosses products made by different entities. Use one technical event record, then open separate manufacturer decisions and routes as supported by the facts.
Reconcile change events
Trigger review after an acquisition, divestiture, rebrand, new distribution model, product combination, substantial modification, change of legal entity, or new Union-market route. Preserve the effective date so responders know which manufacturer owned a version when it was made available.
Run a quarterly exception report for products with no approved manufacturer, no deputy, disputed branding, or stale route evidence. Escalate those gaps as reporting-readiness risks.
Test the register with ambiguity
Use a scenario involving a house-branded imported product, a modified integration, or an acquired legacy release. Ask the responder to identify the manufacturer, product versions, decision authority, reporting route, and user-contact owner from the record alone.
The register succeeds when a real alert reaches one accountable legal decision quickly, with the evidence needed to explain why that entity owns the CRA report.
Continue this workflow with the role-changing manufacturer test and the responsibility chain.