ActLume blogPractical CRA Article 14 guidance for commercial manufacturer reporting teams.https://actlume.com/blog/enCRA Article 14: the 24h, 72h and final-report sequencehttps://actlume.com/blog/cra-article-14-reporting-24-72-final-report/https://actlume.com/blog/cra-article-14-reporting-24-72-final-report/Both Article 14 tracks start with 24-hour and 72-hour stages, but their final-report clocks start from different events.Sun, 23 Aug 2026 00:00:00 GMTWhen does the CRA Article 14 clock start?https://actlume.com/blog/when-cra-article-14-clock-starts/https://actlume.com/blog/when-cra-article-14-clock-starts/The 24-hour and 72-hour windows run from manufacturer awareness of an actively exploited vulnerability or a severe product-security incident.Sun, 23 Aug 2026 00:00:00 GMTWhat is an actively exploited vulnerability under the CRA?https://actlume.com/blog/actively-exploited-vulnerability-meaning/https://actlume.com/blog/actively-exploited-vulnerability-meaning/An actively exploited vulnerability requires reliable evidence that a malicious actor exploited a vulnerability without the system owner's permission.Sun, 23 Aug 2026 00:00:00 GMTHow does the CRA define a severe product-security incident?https://actlume.com/blog/severe-incident-cra-test/https://actlume.com/blog/severe-incident-cra-test/Article 14 treats an incident as severe when it meets either of two product-security impact tests concerning protected data, functions, or malicious code.Sun, 23 Aug 2026 00:00:00 GMTWhat belongs in a CRA 24-hour early warning?https://actlume.com/blog/cra-24-hour-early-warning/https://actlume.com/blog/cra-24-hour-early-warning/The first Article 14 stage is an early warning due without undue delay and within 24 hours of awareness, not a finished investigation report.Sun, 23 Aug 2026 00:00:00 GMTBuilding the CRA 72-hour vulnerability notificationhttps://actlume.com/blog/cra-72-hour-vulnerability-notification/https://actlume.com/blog/cra-72-hour-vulnerability-notification/The 72-hour vulnerability stage adds available product, exploit, vulnerability, mitigation, user-action, and sensitivity information.Sun, 23 Aug 2026 00:00:00 GMTBuilding the CRA 72-hour severe-incident notificationhttps://actlume.com/blog/cra-72-hour-incident-notification/https://actlume.com/blog/cra-72-hour-incident-notification/The 72-hour incident stage carries available general information, an initial assessment, and corrective or mitigating measures.Sun, 23 Aug 2026 00:00:00 GMTWhen is the CRA vulnerability final report due?https://actlume.com/blog/cra-vulnerability-final-report/https://actlume.com/blog/cra-vulnerability-final-report/The final report for an actively exploited vulnerability is due no later than 14 days after a corrective or mitigating measure becomes available.Sun, 23 Aug 2026 00:00:00 GMTWhen is the CRA severe-incident final report due?https://actlume.com/blog/cra-incident-final-report/https://actlume.com/blog/cra-incident-final-report/The final report for a severe incident is due within one month after the 72-hour incident notification.Sun, 23 Aug 2026 00:00:00 GMTThe CRA has two Article 14 reporting trackshttps://actlume.com/blog/cra-two-reporting-tracks/https://actlume.com/blog/cra-two-reporting-tracks/Article 14 separately covers actively exploited vulnerabilities and severe incidents affecting product security, with distinct final-report rules.Sun, 23 Aug 2026 00:00:00 GMTWhat if CRA facts are incomplete at 24 hours?https://actlume.com/blog/cra-24-hour-report-incomplete-facts/https://actlume.com/blog/cra-24-hour-report-incomplete-facts/The CRA early warning comes before the fuller 72-hour notification, so teams need a controlled way to report known facts and preserve uncertainty.Sun, 23 Aug 2026 00:00:00 GMTKeep one evidence trail across CRA reporting stageshttps://actlume.com/blog/cra-reporting-evidence-trail/https://actlume.com/blog/cra-reporting-evidence-trail/CRA notifications develop across the 24-hour, 72-hour, and final stages, making a traceable record of additions and corrections essential.Sun, 23 Aug 2026 00:00:00 GMTHow to record the CRA awareness timestamphttps://actlume.com/blog/record-cra-awareness-timestamp/https://actlume.com/blog/record-cra-awareness-timestamp/CRA reporting windows run from manufacturer awareness, so the case record should distinguish signal receipt, assessment, and the trigger decision.Sun, 23 Aug 2026 00:00:00 GMTBuild a CRA escalation chain that works after hourshttps://actlume.com/blog/cra-after-hours-escalation/https://actlume.com/blog/cra-after-hours-escalation/CRA early warnings and notifications use hour-based deadlines from awareness, so reporting ownership needs tested backups outside normal schedules.Sun, 23 Aug 2026 00:00:00 GMTHow to document a CRA decision not to reporthttps://actlume.com/blog/document-cra-non-reportable-decision/https://actlume.com/blog/document-cra-non-reportable-decision/A non-report decision should show how the evidence was tested separately against the CRA definitions for active exploitation and severe incidents.Sun, 23 Aug 2026 00:00:00 GMTHow the CRA Single Reporting Platform workshttps://actlume.com/blog/how-cra-single-reporting-platform-works/https://actlume.com/blog/how-cra-single-reporting-platform-works/The CRA platform gives manufacturers one electronic entry point that routes a notification to the coordinating CSIRT and ENISA.Sun, 23 Aug 2026 00:00:00 GMTWho does what in the CRA reporting chain?https://actlume.com/blog/cra-reporting-chain-responsibilities/https://actlume.com/blog/cra-reporting-chain-responsibilities/Manufacturers submit; ENISA manages the platform; coordinating CSIRTs receive, assess, and ordinarily disseminate Article 14 notifications.Sun, 23 Aug 2026 00:00:00 GMTHow to choose the CRA coordinating CSIRThttps://actlume.com/blog/choose-cra-coordinating-csirt/https://actlume.com/blog/choose-cra-coordinating-csirt/For an EU-established manufacturer, the CRA starts with the Member State where product-cybersecurity decisions are predominantly taken.Sun, 23 Aug 2026 00:00:00 GMTWhere a CRA report goes after submissionhttps://actlume.com/blog/cra-onward-dissemination/https://actlume.com/blog/cra-onward-dissemination/The coordinating CSIRT ordinarily shares a CRA notification with relevant CSIRTs where the affected product was made available.Sun, 23 Aug 2026 00:00:00 GMTCRA delayed dissemination is an exceptional routehttps://actlume.com/blog/cra-delayed-dissemination/https://actlume.com/blog/cra-delayed-dissemination/A coordinating CSIRT may delay onward dissemination only under the CRA's exceptional, justified cybersecurity conditions and for a strictly necessary period.Sun, 23 Aug 2026 00:00:00 GMTHow the CRA routes reports from non-EU manufacturershttps://actlume.com/blog/cra-non-eu-routing-cascade/https://actlume.com/blog/cra-non-eu-routing-cascade/A manufacturer with no EU main establishment follows an ordered CRA routing test based on its representative, importer, distributor, then users.Sun, 23 Aug 2026 00:00:00 GMTBuild continuity for CRA reporting accesshttps://actlume.com/blog/cra-srp-access-readiness/https://actlume.com/blog/cra-srp-access-readiness/Prepare an internal primary-and-backup submission path around the CRA's staged reporting deadlines without relying on unverified platform mechanics.Sun, 23 Aug 2026 00:00:00 GMTA CRA report is one submission, not two filingshttps://actlume.com/blog/one-cra-submission-not-two/https://actlume.com/blog/one-cra-submission-not-two/Manufacturers submit once through the CRA platform, which routes the notification to the coordinating CSIRT and makes it available to ENISA.Sun, 23 Aug 2026 00:00:00 GMTWhen the CRA requires an impacted-user noticehttps://actlume.com/blog/cra-impacted-user-notification/https://actlume.com/blog/cra-impacted-user-notification/After awareness of an actively exploited vulnerability or severe product-security incident, the manufacturer must inform impacted users and sometimes all users.Sun, 23 Aug 2026 00:00:00 GMTWhat a useful CRA user notice needs to sayhttps://actlume.com/blog/cra-user-notice-content/https://actlume.com/blog/cra-user-notice-content/A CRA user notice should identify the affected product and give deployable mitigation or corrective steps where those measures are necessary.Sun, 23 Aug 2026 00:00:00 GMTWhen a component vulnerability becomes your CRA reporthttps://actlume.com/blog/cra-third-party-component-reporting/https://actlume.com/blog/cra-third-party-component-reporting/A supplier's exploited flaw does not answer the final-product question; the manufacturer must establish whether its own product contains and is affected by it.Sun, 23 Aug 2026 00:00:00 GMTBuild the CRA handoff to a component maintainerhttps://actlume.com/blog/cra-component-maintainer-handoff/https://actlume.com/blog/cra-component-maintainer-handoff/The CRA requires manufacturers that identify an integrated-component vulnerability to report it upstream and address it in their own product.Sun, 23 Aug 2026 00:00:00 GMTMap vulnerable components to CRA product versionshttps://actlume.com/blog/map-components-to-cra-product-versions/https://actlume.com/blog/map-components-to-cra-product-versions/CRA reporting needs product-specific information, so component evidence must resolve to shipped product versions rather than stop at a dependency name.Sun, 23 Aug 2026 00:00:00 GMTKeep stable identifiers across a CRA reporting casehttps://actlume.com/blog/cra-report-identifiers/https://actlume.com/blog/cra-report-identifiers/Use one internal case anchor to reconcile the manufacturer, product, affected versions, evidence, and staged Article 14 submissions.Sun, 23 Aug 2026 00:00:00 GMTBuild the Member State record for a CRA warninghttps://actlume.com/blog/cra-member-state-availability-record/https://actlume.com/blog/cra-member-state-availability-record/The CRA early warning identifies, where applicable, Member States where the manufacturer knows the product was made available.Sun, 23 Aug 2026 00:00:00 GMTBuild the pre-11 September 2026 exploitation baselinehttps://actlume.com/blog/cra-pre-deadline-exploitation-awareness/https://actlume.com/blog/cra-pre-deadline-exploitation-awareness/Article 14 reporting applies from 11 September 2026, so manufacturers need a dated baseline that separates earlier evidence from later awareness events.Sun, 23 Aug 2026 00:00:00 GMTCRA reporting can apply to manufacturers outside the EUhttps://actlume.com/blog/cra-reporting-non-eu-manufacturers/https://actlume.com/blog/cra-reporting-non-eu-manufacturers/Manufacturer location does not remove CRA reporting when an in-scope product is made available on the Union market.Sun, 23 Aug 2026 00:00:00 GMTWhen a CRA importer or distributor becomes the manufacturerhttps://actlume.com/blog/cra-importer-distributor-manufacturer-role/https://actlume.com/blog/cra-importer-distributor-manufacturer-role/An importer or distributor takes manufacturer obligations, including Articles 13 and 14, when it uses its own name or trademark or substantially modifies the product.Sun, 23 Aug 2026 00:00:00 GMTThe CRA reporting boundary for open-source stewardshttps://actlume.com/blog/cra-open-source-steward-reporting/https://actlume.com/blog/cra-open-source-steward-reporting/Article 24 links steward vulnerability reporting to development involvement and severe-incident reporting to development systems the steward provides.Sun, 23 Aug 2026 00:00:00 GMTIs an open-source maintainer a CRA steward?https://actlume.com/blog/cra-maintainer-or-open-source-steward/https://actlume.com/blog/cra-maintainer-or-open-source-steward/A CRA open-source software steward is a legal person providing systematic, sustained support for specified software intended for commercial activities.Sun, 23 Aug 2026 00:00:00 GMTResolve conflicting CRA exploitation signalshttps://actlume.com/blog/resolve-conflicting-cra-exploitation-signals/https://actlume.com/blog/resolve-conflicting-cra-exploitation-signals/A CRA active-exploitation decision turns on reliable evidence of malicious use without the system owner's permission, not on a label or score alone.Sun, 23 Aug 2026 00:00:00 GMTSeparate product-security events from enterprise incidentshttps://actlume.com/blog/separate-product-security-from-enterprise-incidents/https://actlume.com/blog/separate-product-security-from-enterprise-incidents/CRA severe-incident reporting concerns an incident that affects or can affect a product's ability to protect specified data or functions, or enables malicious code.Sun, 23 Aug 2026 00:00:00 GMTBuild a manufacturer register for CRA reportinghttps://actlume.com/blog/cra-reporting-manufacturer-register/https://actlume.com/blog/cra-reporting-manufacturer-register/CRA Article 14 duties attach to the manufacturer of the affected product, so a reporting runbook needs a product-specific legal-entity map.Sun, 23 Aug 2026 00:00:00 GMTBuild a handoff packet for each CRA report stagehttps://actlume.com/blog/cra-stage-handoff-packet/https://actlume.com/blog/cra-stage-handoff-packet/Preserve the approved facts, unresolved questions, and filing evidence at the early-warning, 72-hour, and final Article 14 stages.Sun, 23 Aug 2026 00:00:00 GMTClassify CRA report sensitivity before submissionhttps://actlume.com/blog/classify-cra-report-sensitivity/https://actlume.com/blog/classify-cra-report-sensitivity/CRA 72-hour notifications indicate, where applicable, how sensitive the manufacturer considers the reported information to be.Sun, 23 Aug 2026 00:00:00 GMTTriage one event under both the CRA and NIS2https://actlume.com/blog/cra-and-nis2-parallel-triage/https://actlume.com/blog/cra-and-nis2-parallel-triage/The same security event can require separate assessment under the CRA's product-manufacturer test and NIS2 rules applying to an affected entity.Sun, 23 Aug 2026 00:00:00 GMTTriage a product incident under the CRA and GDPRhttps://actlume.com/blog/cra-and-gdpr-breach-triage/https://actlume.com/blog/cra-and-gdpr-breach-triage/A security event may require both a CRA product-security assessment and a GDPR personal-data-breach assessment because the regimes ask different questions.Sun, 23 Aug 2026 00:00:00 GMTDecide when to use CRA voluntary reportinghttps://actlume.com/blog/cra-voluntary-reporting-decision/https://actlume.com/blog/cra-voluntary-reporting-decision/CRA Article 15 permits voluntary notification of vulnerabilities, cyber threats, incidents, and near misses beyond the narrower mandatory Article 14 triggers.Sun, 23 Aug 2026 00:00:00 GMTProve delivery of a CRA user noticehttps://actlume.com/blog/cra-user-notice-delivery-evidence/https://actlume.com/blog/cra-user-notice-delivery-evidence/CRA user communication is risk-based: manufacturers inform impacted users and, where appropriate, all users without implying that every case requires indiscriminate public disclosure.Sun, 23 Aug 2026 00:00:00 GMTSeparate the CRA's 2026 and 2027 workstreamshttps://actlume.com/blog/cra-2026-and-2027-deadlines/https://actlume.com/blog/cra-2026-and-2027-deadlines/CRA conformity-body provisions apply from 11 June 2026, Article 14 reporting from 11 September 2026, and most remaining provisions from 11 December 2027.Sun, 23 Aug 2026 00:00:00 GMTBring legacy products into CRA reporting triagehttps://actlume.com/blog/cra-reporting-legacy-products/https://actlume.com/blog/cra-reporting-legacy-products/CRA Article 14 reporting applies to in-scope products made available before 11 December 2027, not only to products launched after the main application date.Sun, 23 Aug 2026 00:00:00 GMTRecord when a CRA corrective measure becomes availablehttps://actlume.com/blog/cra-corrective-measure-available-timestamp/https://actlume.com/blog/cra-corrective-measure-available-timestamp/For an actively exploited vulnerability, the CRA final report is due no later than 14 days after a corrective or mitigating measure becomes available.Sun, 23 Aug 2026 00:00:00 GMTDo not mistake CRA small-business penalty relief for a deadline waiverhttps://actlume.com/blog/cra-small-business-24-hour-rule/https://actlume.com/blog/cra-small-business-24-hour-rule/CRA Article 64 prevents fines for certain micro and small manufacturers that miss the 24-hour early-warning deadline, but it does not remove Article 14 reporting duties.Sun, 23 Aug 2026 00:00:00 GMTPrepare an effective request to a CRA reporting helpdeskhttps://actlume.com/blog/cra-sme-reporting-helpdesk/https://actlume.com/blog/cra-sme-reporting-helpdesk/The CRA requires coordinating CSIRTs to provide helpdesk support for reporting, with particular attention to microenterprises and small and medium-sized enterprises.Sun, 23 Aug 2026 00:00:00 GMTRun a complete CRA reporting readiness exercisehttps://actlume.com/blog/cra-reporting-readiness-exercise/https://actlume.com/blog/cra-reporting-readiness-exercise/CRA Article 14 reporting begins on 11 September 2026 and uses separate staged sequences for actively exploited vulnerabilities and severe incidents.Sun, 23 Aug 2026 00:00:00 GMT