Article 14 has two report tracks. One covers flaws under active attack. The other covers severe events that harm product security. Both have an early warning and a 72-hour stage. Their final clocks and content are not the same.
Do not force each case into one “CRA report” field. A case may need both tests. Each result needs its own proof and choice owner.
Use a two-column triage record
For the flaw track, ask if the product has the flaw. Then ask if sound proof shows a bad actor used it without leave. For the event track, apply both severe-event tests to the harm to product security.
Give each track one of four states: open, met, not met, or cannot decide. Add the choice time, reviewer, proof, and next review fact. Do not use a plain “closed” state that hides which test ended.
Share evidence without merging decisions
Use one event ID and proof index. Give each track its own choice sheet. A product map, timeline, or code fact may support both. State how it matters to each trigger on its own.
If sound proof shows a bad actor used a product flaw, record that in the flaw column. Then run both severe-event tests. If they fail, keep the reason. Do not assume that one report track makes the other test moot.
The reverse is also true. A severe event does not prove that a flaw is under active attack. Keep the flaw result open, not met, or met based on its own proof.
Keep the deadlines attached to the track
Once a trigger is met, build its report stages from the saved awareness time. The flaw final report ties to when a fix or risk step is ready. The severe-event final report ties to the 72-hour filing.
One case record can hold both tracks. Keep their facts, choices, due times, and filings apart. This also makes later fixes easier to explain.
Design the handoff for dual outcomes
The event lead should see two owners and two trigger states. Show two awareness choices if their times differ. Show the later work for each track. The filing person should know which approved facts go in each report and which proof is shared.
Before closure, test three faults. Was one track never checked? Was a due time copied to the wrong track? Did a new fact change one result but update both? Set reopen rules so later product or attack proof reaches the right sheet.
The goal is not two fact reviews. One proof process feeds two clear legal choices. Each has its own clock and final-report path.
Review the complete Article 14 reporting sequence, or continue this workflow with the actively exploited vulnerability test and the severe-incident test.