ActLume

ActLume blog

Reporter articles

CRA Article 14 guidance written for the reporter workflow role.

Reporter articles

10 available

  1. A compact orange information packet with a deadline clock sends one bounded alert from nested green fields. What should a manufacturer prepare for the CRA Article 14 24-hour early warning?

    What belongs in a CRA 24-hour early warning?

    The first Article 14 stage is an early warning due without undue delay and within 24 hours of awareness, not a finished investigation report.

    3 min read
  2. Six evidence tiles lock into a compact square dossier around an orange centre. What information belongs in the CRA 72-hour vulnerability notification?

    Prepare the CRA 72-hour vulnerability notification

    The 72-hour vulnerability stage adds available product, exploit, vulnerability, mitigation, user-action, and sensitivity information.

    3 min read
  3. A 72-hour information card, incident pulse, and checked mitigation shield sit inside a pale inspection lens. What should a manufacturer prepare for the CRA 72-hour severe-incident notification?

    Prepare the CRA 72-hour incident notification

    The 72-hour incident stage carries available general information, an initial assessment, and corrective or mitigating measures.

    3 min read
  4. A square orbit of evidence blocks surrounds an orange incident core and an open mitigation path. What starts the CRA final-report deadline for a severe product-security incident?

    When is the CRA severe-incident final report due?

    The final report for a severe incident is due within one month after the 72-hour incident notification.

    3 min read
  5. Separate evidence fragments gather inside an open square frame. What should a manufacturer do when facts are incomplete at the CRA 24-hour reporting stage?

    What if CRA facts are incomplete at 24 hours?

    The CRA early warning comes before the fuller 72-hour notification, so teams need a controlled way to report known facts and preserve uncertainty.

    3 min read
  6. One orange decision centre selects a single path among four green locations. How does an EU-established manufacturer choose the coordinating CSIRT for CRA Article 14 reporting?

    How to choose the CRA coordinating CSIRT

    For an EU-established manufacturer, the CRA starts with the Member State where product-cybersecurity decisions are predominantly taken.

    3 min read
  7. A single orange card enters a green split route ending at two equal nodes. Must a manufacturer file separate CRA notifications with ENISA and its coordinating CSIRT?

    A CRA report is one submission, not two filings

    Manufacturers submit once through the CRA platform, which routes the notification to the coordinating CSIRT and makes it available to ENISA.

    3 min read
  8. An orange component packet moves across a bridged gap between two green blocks. What should a manufacturer do after identifying a vulnerability in a third-party component integrated into its product?

    Build the CRA handoff to a component maintainer

    The CRA requires manufacturers that identify an integrated-component vulnerability to report it upstream and address it in their own product.

    3 min read
  9. An orange case marker anchors five distinct green identifier tabs in a square index. How should a manufacturer keep identifiers coherent across an Article 14 reporting case?

    Keep stable CRA case identifiers

    Use one internal case anchor to reconcile the manufacturer, product, affected versions, evidence, and staged Article 14 submissions.

    3 min read
  10. Selected orange markers sit across a grid of green territory tiles. How should a manufacturer determine which Member States to identify in a CRA early warning?

    Build the Member State record for a CRA warning

    The CRA early warning identifies, where applicable, Member States where the manufacturer knows the product was made available.

    3 min read