The CRA Article 14 clock starts when the manufacturer becomes aware of the relevant reporting trigger. For an actively exploited vulnerability or a severe incident affecting product security, the law sets an early warning without undue delay and in any event within 24 hours, followed by a fuller notification within 72 hours.
That makes the awareness record an operational boundary, not a diary note added after the response. A useful record identifies the signal, the product, the evidence available at the time, the person who assessed it, and the moment the organisation concluded that the trigger was met.
Separate receipt from awareness
A raw alert does not explain its own legal significance. Record when the alert arrived, but keep that timestamp distinct from the point at which the manufacturer reached the awareness threshold. The distinction should be supported by the evidence actually available at each point.
Avoid moving the awareness time to the end of a forensic investigation. The 24-hour stage exists so an initial warning can be made before every detail is known. Later stages are designed to carry the developing assessment.
Build one defensible timeline
Use a single UTC timeline for the event and retain local times only as supporting context. Include changes in the product scope, exploitation evidence, incident severity assessment, and decision ownership. Corrections should be appended with an author and timestamp rather than silently replacing the original entry.
Resolve competing candidate times
An event can produce several plausible timestamps: a supplier alert, an automated detection, an analyst’s product match, a manager’s escalation, and a later legal review. Put every candidate on the same timeline and state what each event established. Do not select the latest time merely because it has the cleanest documentation.
Ask the technical reviewer to identify when the evidence first connected the event to the manufacturer’s product. Ask the reporting reviewer to identify when the available evidence supported one of the Article 14 triggers. If they disagree, preserve both analyses, the unresolved point, and the person accountable for the clock decision.
The record should also distinguish a new awareness event from a correction to an old timestamp. A changed product match, newly reliable exploitation evidence, or a revised incident assessment may alter the legal analysis. It should not silently alter the source history.
Hand off a clock packet
Before the case moves to the reporter, package the chosen awareness time, time zone, trigger, evidence references, contrary evidence, decision owner, and calculation of the 24-hour and 72-hour limits. Attach the original records rather than copying their conclusions into an unsupported narrative.
Set the next review condition. If the trigger is not yet met, name the evidence that would reopen the decision and who monitors for it. If it is met, hand the same packet to the reporter so the external timeline and internal audit trail start from one decision.
The practical goal is modest: another qualified reviewer should be able to reconstruct why the reporting clock was treated as starting when it did. Legal counsel should review difficult cases; this article is not legal advice.
Review the complete Article 14 reporting sequence, or continue this workflow with the awareness-timestamp packet and the two-track triage.