Which cases are covered
The duty concerns manufacturers of products with digital elements within the Cyber Resilience Act's scope. It covers actively exploited vulnerabilities and severe incidents affecting product security. Running a company website does not, by itself, make its operator a manufacturer subject to these duties.
Start with the product, your role and the actual event. A generic scanner finding does not establish active exploitation. Keep observations, confirmed facts and unanswered questions separate when making the internal decision. [1] [2]
The clock starts at awareness
The 24-hour and 72-hour periods share the same starting point. Record it with the time zone and the basis for your assessment. Add new findings to the same case record with their own timestamps. [1] [5]
- 00
Awareness of the reportable case
- 24 h
Early warning · within 24 hours
From awareness.
- 72 h
Notification · within 72 hours
Also from awareness, not from the early warning.
Final report: actively exploited vulnerability
Within 14 days of a corrective or mitigating measure becoming available.
Final report: severe security incident
Within one month of the 72-hour notification.
Simplified timeline. Report without undue delay; the deadlines shown are maximum limits. The final report has a separate starting point depending on the type of case.
Give the reporting process named owners
Notifications go through ENISA's Single Reporting Platform (SRP) to the coordinating CSIRT and, as a rule, ENISA. Assigned representatives need a personal EU Login account with multi-factor authentication.
Name a lead and a deputy internally. Prepare EU Login and access arrangements. ENISA currently advises initiating manufacturer registration and validation on the SRP only when a notification is actually needed. Check the latest official instructions before using the platform. [3] [4]
Keep one case record
Our practical recommendation: bring together the product and affected versions, awareness time, technical evidence, impact, measures already taken and unanswered questions. Give every next action an owner and a deadline.
This lets a deputy distinguish established facts from points still under investigation. Retain the submissions as sent, together with their submission times. Later updates should remain traceable without turning an initial assessment into apparent certainty.
Current platform note: check the counter
ENISA's FAQ updated on 3 October 2026 describes a current SRP limitation: the 72-hour counter displays a deadline 48 hours after the early warning was submitted. It can therefore show a notification as overdue before 72 hours have passed since awareness.
Track the applicable deadline internally as well. The display does not replace the legal deadline assessment. ENISA plans to change the calculation; check the current platform guidance for an actual case. [4]
Use a short rehearsal to find gaps
Walk through a fictional case internally, without submitting a report to an authority. Who receives the initial information, assesses the affected product, makes the decision and covers out-of-hours events? Check that the deputy can find the case record.
Finish with a short list of concrete improvements: missing access, unclear cover, an outdated product list or an undocumented decision. Resolve these before the next real security case.
Download a CRA reporting readiness checklist
Use the worksheet for internal preparation: assign each open item, record its evidence and agree a review date. It records readiness; it is neither a notification to ENISA nor a complete statement of legal obligations.
Rehearse a handover using a fictional case reference. Record where a deputy can find the latest internal case record. Keep supporting evidence in an access-controlled location and use references in the worksheet. Do not enter credentials or raw personal data.
Swipe or scroll sideways to read the table.
| Area | Decide in advance | Handover evidence |
|---|---|---|
| Scope | Which products and manufacturer role are relevant? | Reviewed product list and decision |
| Awareness | Who records the time, time zone and basis for the assessment? | Traceable case chronology |
| Responsibility | Who decides, who submits and who covers absence? | Confirmed roles and available deputy |
| Follow-up | Who maintains new findings and upcoming deadlines? | Current case record and accepted handover |