ActLume

ActLume blog

Reviewer articles

CRA Article 14 guidance written for the reviewer workflow role.

Reviewer articles

8 available

  1. An orange intrusion path reaches one product core while three unconfirmed paths remain outside. What makes a vulnerability actively exploited for CRA Article 14 reporting?

    CRA actively exploited vulnerabilities explained

    An actively exploited vulnerability requires reliable evidence that a malicious actor exploited a vulnerability without the system owner's permission.

    3 min read
  2. An orange evidence marker rests below two completed green decision gates. How should a manufacturer document a decision that a product-security case is not reportable under CRA Article 14?

    How to document a CRA decision not to report

    A non-report decision should show how the evidence was tested separately against the CRA definitions for active exploitation and severe incidents.

    3 min read
  3. Two orange evidence markers fall on opposite sides of a thick green boundary. How should a manufacturer prepare vulnerability-awareness records before Article 14 reporting starts?

    Prepare a pre-deadline exploitation baseline

    Article 14 reporting applies from 11 September 2026, so manufacturers need a dated baseline that separates earlier evidence from later awareness events.

    3 min read
  4. A green product tile passes through a square gate and emerges as an orange ownership tile. When does the CRA treat an importer or distributor as the manufacturer for reporting purposes?

    When CRA supply-chain firms become manufacturers

    An importer or distributor takes manufacturer obligations, including Articles 13 and 14, when it uses its own name or trademark or substantially modifies the product.

    3 min read
  5. Three non-overlapping role frames compare an orange person marker, support ring, and product tile. Does maintaining an open-source project make a person an open-source software steward under the CRA?

    Is an open-source maintainer a CRA steward?

    A CRA open-source software steward is a legal person providing systematic, sustained support for specified software intended for commercial activities.

    3 min read
  6. Four uneven evidence tiles balance around a central orange decision point. How should a manufacturer resolve conflicting evidence about whether a vulnerability is actively exploited under the CRA?

    Resolve conflicting CRA exploitation signals

    A CRA active-exploitation decision turns on reliable evidence of malicious use without the system owner's permission, not on a label or score alone.

    3 min read
  7. One orange packet advances through three stacked green stage frames. What evidence should move between the early warning, 72-hour notification, and final CRA report?

    Build a handoff packet for each CRA report stage

    Preserve the approved facts, unresolved questions, and filing evidence at the early-warning, 72-hour, and final Article 14 stages.

    3 min read
  8. An orange optional signal branches beside a firm green reporting path. When should a manufacturer or another person consider a voluntary CRA notification?

    Decide when to use CRA voluntary reporting

    CRA Article 15 permits voluntary notification of vulnerabilities, cyber threats, incidents, and near misses beyond the narrower mandatory Article 14 triggers.

    3 min read