The CRA gives some very small and small makers a narrow shield from fines. It covers a missed 24-hour early-warning due time. It does not remove the duty to send the warning. The stated shield does not cover the 72-hour or final report due times.
Treat this as a fine rule to review with a lawyer. Do not use it as the firm’s event plan.
Confirm the entity before the incident
Name the legal maker for each product. Check if that entity meets the legal term for a very small or small firm. Keep the staff count, money facts, control links, and related-firm check for the right time. Do not infer the status from one brand team or local pay list.
Give the size choice and review date to finance or legal staff. Product security should use an approved result. It should not work out firm size during an event.
If the status is in doubt or may change, plan to the normal due times. Keep the doubt in the record.
Keep the full reporting sequence
Keep the same core steps as a large maker. Cover intake, awareness, early warning, 72-hour notice, final report, user note, and saved proof. Name a main and backup choice owner. Prepare the product ID, report route, and stage forms.
A small team needs a short early-warning pack and clear power to act. The fine rule is not a reason to wait for a full fact review.
Separate three records
The event record shows the awareness time, choice, due time, filing, and proof. The size record supports whether Article 64(10) applies. The legal check explains the result of a missed due time.
Do not merge them into a note called “small firm exception.” That hides which entity counts, which due time was missed, and which duties stay open.
If the 24-hour due time is near or past, keep filing without undue delay. Save the reason and ask a lawyer to review it. Do not let talk about fines use the time needed for the 72-hour notice.
Plan for limited staffing honestly
Use an on-call plan that reaches one owner and one backup outside the product team. Approve alert contacts in advance. Keep a short proof list. Set up expert or legal aid before an event if the in-house team is thin.
Run a weekend or holiday drill. Test if the team can name the maker, prove the trigger, send the early warning, and prepare the 72-hour check. Record gaps as work risks. Do not assume the fine rule covers them.
Record entity size with care and keep the fine rule narrow. Build the skill to meet every Article 14 stage.
Continue this workflow with the application-date workstreams and the helpdesk-request packet.