CRA voluntary reporting is broader than mandatory Article 14 reporting. Article 15 allows reports about vulnerabilities and cyber threats. It also covers product-security incidents and near misses. A manufacturer may report, but other people and legal entities may do so too.
That wide scope needs a clear decision process. A voluntary report must never downgrade a mandatory event. It should not turn every weak signal into an uncontrolled disclosure either.
Finish the mandatory test first
First test whether the event is mandatory. Ask if the product contains an actively exploited vulnerability. Also ask if a severe incident affects product security.
Use Article 14 when either mandatory trigger is met. Follow its deadlines. Do not choose the voluntary route because the facts are awkward. An incomplete mandatory packet is not a reason to switch routes.
Article 15 may still apply when the mandatory test fails. It may also apply when the notifier is not the legal manufacturer. Name the remaining category. It may be a vulnerability, a cyber threat, a less severe incident, or a near miss. A cyber threat must affect the product’s risk profile.
State the coordination purpose
State the goal in one sentence. The goal may be to flag a vulnerability that spans several products. It may be to share a credible threat that changes product risk. A near miss with wider value may also justify coordination.
Name the action you want the recipient to consider. Do not assume that action will occur. A vague wish to “be transparent” is not enough. It cannot guide a decision about sensitive technical details.
Prepare a bounded packet
Identify the notifier and give a contact route. Name the affected product or component as far as known. State the event category and describe the evidence. Add a short technical account, key dates, and the current status.
Record any coordination already tried. State how the recipient should handle the report. Keep confirmed observations separate from analysis. Mark statements that came from a third party.
Remove personal data that is not needed. Remove credentials, secrets, and unrelated customer material. Article 15 requires the receiving bodies to protect the report. The notifier still needs an internal disclosure review. Use an approved transmission path.
A notifier outside the manufacturer has extra work. Keep evidence of attempts to contact the manufacturer or maintainer. Explain whether urgent risk changes the plan. Avoid an early public disclosure.
Approve and track the choice
Product security should check the technical facts. A legal or policy owner should approve the external report.
Record why a voluntary report is suitable. Explain why Article 14 does not control the filing. List any details held back. State what new fact would change the route.
Check the current official filing method before sending anything. Platform features and instructions may change. That does not change the legal permission in Article 15.
Keep the filed content, time, channel, and reference. Keep any reply.
Reassess new evidence
A voluntary report does not freeze the case. New evidence may prove active exploitation or a severe incident. The manufacturer must then open a mandatory decision. Run the Article 14 sequence from the supported awareness point.
Link the voluntary and mandatory records. Authorities and internal reviewers should be able to see the change.
The result is a focused voluntary report. It has a clear coordination goal and controlled content. It also keeps a firm boundary around mandatory reporting.
Continue this workflow with the two-track triage and the non-reportable decision record.