Article 14 reports start on 11 September 2026. A drill should test the full path for one product alert. Test intake, the legal check, each report stage, user notice, and saved proof. Use time limits that feel real.
A drill is not a legal result for a real flaw. It must not send a real report. Mark each file as drill material.
Choose a scenario that tests the system
Use a real product design, but make up the event facts. A good flaw case can include:
- a sign of attack from an outside source;
- a flaw in a part from a supplier;
- doubt about the product versions at risk;
- an alert on a weekend; and
- a short-term fix before the full patch.
A good event case can test a hacked release or update path. Add doubt about product harm and facts from several Member States. Add a secret fact and a possible duty under another law.
Choose one main track. Add facts that tempt the team to switch tracks or mix them. Check that it does not.
Establish rules and observers
Name one person to release each new fact. Name one person to log times and choices. Include the teams that would take part in a real case. These may be security, response, code, legal, privacy, support, and sales. Include the person who would file the report.
Set a clear stop rule. No one may file with an authority, contact real users, or change a live system. Use a separate work area and fake contact data.
Set pass marks before the drill. Time how long the team takes to:
- accept the alert;
- name the maker and product;
- choose the legal trigger;
- record awareness;
- choose the report route;
- prepare each stage;
- approve the user note; and
- close the proof record.
Run the decision phase
Give the first alert without a result. The team should save its source and map it to product versions. It must tell a real attack from a flaw that could be used. For an event track, it must test product harm. It must list gaps and name the choice owner.
Watch how the team records doubt. Add a source that conflicts with the first one. Make the main responder hard to reach. The team should still reach an approved choice. It should state which new fact would reopen it.
Exercise the reporting handoffs
If the test is met, prepare a fake early warning and 72-hour notice. Plan the final report on the right track. Check the product name, Member State record, secret-data review, approval, filing handoff, and fake receipt.
For the flaw track, add a fix or way to cut the risk. For the event track, treat the 72-hour notice as filed. The team must work out the final due trigger and save its proof.
Exercise user and parallel duties
Name the users at risk. Choose fair ways to reach them. Draft steps they can take and save fake proof of delivery. Add one group owned by a seller and one group that cannot be reached.
Ask legal and privacy leads to find other laws or deals that need a separate check. They may share facts. They must not treat the CRA drill file as a report for every duty.
Close with evidence, not impressions
Keep the timeline, choices, drafts, approvals, route check, access results, user map, and drill notes. Give each gap an owner, fix, proof need, and due date. Test the failed step again. Do not wait for next year’s drill.
The drill passes when a reviewer can rebuild the case. The record must show what the team knew, who chose, and which path it took. It must show how the team kept users and secret facts safe. It must also prove each fake handoff.
Continue this workflow with the after-hours escalation chain and the stage-handoff packet.