ActLume

ActLume blog

Organisation admin articles

CRA Article 14 guidance written for the organisation admin workflow role.

Organisation admin articles

10 available

  1. An orange entry reaches a central green platform surrounded by routed endpoints. How does the CRA Single Reporting Platform route a manufacturer's Article 14 notification?

    How the CRA Single Reporting Platform works

    The CRA platform gives manufacturers one electronic entry point that routes a notification to the coordinating CSIRT and ENISA.

    3 min read
  2. Five distinct stations form a green arc around one orange submission tile. What are the responsibilities of the manufacturer, ENISA, and coordinating CSIRT in CRA reporting?

    Who does what in the CRA reporting chain?

    Manufacturers submit; ENISA manages the platform; coordinating CSIRTs receive, assess, and ordinarily disseminate Article 14 notifications.

    3 min read
  3. Four offset green gates lead an orange signal toward one central destination. Which coordinating CSIRT should a manufacturer without an EU main establishment use for CRA reporting?

    How CRA reporting routes non-EU manufacturers

    A manufacturer with no EU main establishment follows an ordered CRA routing test based on its representative, importer, distributor, then users.

    3 min read
  4. An orange product tile crosses an angled boundary toward four green market tiles. Do CRA Article 14 reporting obligations apply to manufacturers established outside the European Union?

    CRA reporting for manufacturers outside the EU

    Manufacturer location does not remove CRA reporting when an in-scope product is made available on the Union market.

    3 min read
  5. An orange stewardship marker bridges a green code plane and a separate infrastructure ring. Which Article 14 reporting duties apply to an open-source software steward?

    CRA reporting duties for open-source stewards

    Article 24 links steward vulnerability reporting to development involvement and severe-incident reporting to development systems the steward provides.

    3 min read
  6. Four green product tiles resolve to one selected orange manufacturer record. How should a product group identify the legal manufacturer that owns each CRA Article 14 decision?

    Build a manufacturer register for CRA reporting

    CRA Article 14 duties attach to the manufacturer of the affected product, so a reporting runbook needs a product-specific legal-entity map.

    4 min read
  7. Three staggered planning cards give conformity, live reporting, and product duties their own orange calendar gates. What must a manufacturer separate when planning for the CRA's 2026 and 2027 application dates?

    Separate the CRA's 2026 and 2027 workstreams

    CRA conformity-body provisions apply from 11 June 2026, Article 14 reporting from 11 September 2026, and most remaining provisions from 11 December 2027.

    3 min read
  8. A small orange tile passes a green clock while a separate shield covers only one segment. Does the CRA exempt a microenterprise or small enterprise from the 24-hour early-warning duty?

    CRA small-business relief does not waive deadlines

    CRA Article 64 prevents fines for certain micro and small manufacturers that miss the 24-hour early-warning deadline, but it does not remove Article 14 reporting duties.

    3 min read
  9. An orange question tile aligns with three green support-response blocks. What should a smaller manufacturer prepare before asking a CRA reporting helpdesk for support?

    Ask a CRA reporting helpdesk a useful question

    The CRA requires coordinating CSIRTs to provide helpdesk support for reporting, with particular attention to microenterprises and small and medium-sized enterprises.

    3 min read
  10. Five connected green readiness stations form a loop around one orange scenario marker. How should a manufacturer run an end-to-end exercise of its CRA Article 14 reporting capability?

    Run a complete CRA reporting readiness exercise

    CRA Article 14 reporting begins on 11 September 2026 and uses separate staged sequences for actively exploited vulnerabilities and severe incidents.

    4 min read