The CRA’s early-warning and 72-hour windows are measured from manufacturer awareness. A defensible case record therefore needs more than a single unexplained timestamp.
Start by separating three events: when a signal reached the organisation, when a qualified assessment had the relevant evidence, and when the organisation concluded that an Article 14 trigger was met. They may coincide, but they should not be collapsed by default.
Capture the decision packet
Record the time in UTC, the person or function making the determination, the product and versions considered, and the evidence available at that moment. Preserve the source timestamps of alerts, customer reports, telemetry, and technical analysis.
If a signal moves between teams, retain the handoff times. If the assessment changes, append the new conclusion and reason; do not rewrite the original entry. The record should show whether new evidence changed the legal trigger analysis or only refined the scope.
Compare candidate events
List every event that could plausibly matter: intake, automated detection, analyst verification, product containment, exploitation confirmation, severity assessment, and accountable escalation. For each, write the exact proposition the evidence supported at that moment.
The first alert may identify a weakness but not connect it to the manufacturer’s product. A later analysis may establish the product match while exploitation remains unverified. Another source may change the severe-incident assessment without changing when the earlier facts were received. Keeping those propositions separate prevents a convenient administrative time from replacing the evidence history.
If technical and legal reviewers select different candidates, preserve both decisions and the disagreement. The accountable clock owner should record the adopted time, rationale, and any conservative handling of the deadline.
Make the timestamp usable
Attach the staged deadlines to the approved awareness time and make them visible to the response owners. Keep an explicit timezone on every display, and test daylight-saving and cross-border handoffs before a real case.
Export a clock packet for the reporter containing the adopted UTC time, local-time context where useful, reporting track, product scope, sources, reviewer, and calculated limits. Require any correction to create a new version with its own author and time.
Test the record with a colleague who did not participate in the incident. They should be able to locate the original evidence, distinguish receipt from awareness, reproduce the deadline calculation, and identify the unresolved issue without consulting chat history.
There will be difficult fact patterns. The purpose of this record is not to manufacture certainty; it is to preserve who knew what, when, and why. Counsel should decide contested interpretations.
Continue this workflow with the clock-start analysis and the pre-start exploitation baseline.