CRA reporting clock starts the moment you *know*, not when it suits you

When the clock starts

The CRA reporting deadlines work like losing your bank card: the clock starts when you notice it's gone, not when it's convenient to call the bank. Article 14 of the Cyber Resilience Regulation (EU) 2024/2847 requires manufacturers of products with digital elements to report actively exploited vulnerabilities and serious incidents in stages, and each stage has a short deadline ^[1].

The rule has applied since 11 September 2026 ^[1]. It covers connected hardware and software placed on the EU market, but not medical devices or type-approved vehicles ^[1].

What has to be reported

Two kinds of events trigger the duty: an actively exploited vulnerability in a product with digital elements, and a serious incident ^[1].

An actively exploited vulnerability means a security flaw that attackers are already using in the wild. A serious incident, under the CRA, is one that causes significant disruption, causes or may cause death or serious injury, causes or may cause significant material or immaterial damage to a natural or legal person, or affects public or national security ^[1].

The regulation doesn't define when you have enough information to say an incident is serious. What it does say is that the clock starts when you become aware.

The 24-hour warning

Within 24 hours of becoming aware of an actively exploited vulnerability or a serious incident, the manufacturer must submit an early warning through ENISA's unified reporting platform ^[1].

That warning doesn't need to contain everything. The point is to get the information out fast. Article 14(2) lists what the early warning should include where that information is available at the time: the product concerned, details of the vulnerability or incident, whether it's already being exploited, its severity and impact, and the manufacturer's initial assessment ^[1].

Some of that may not yet be clear within 24 hours. The rule is to submit what you know.

The final report

The final report has a longer deadline: 14 days for an actively exploited vulnerability, one month for a serious incident ^[1].

That report must include a detailed description, the severity, any impact on other products or services, how widespread the exploitation or impact is, mitigating measures the manufacturer has taken or recommends, and, for vulnerabilities, information to help users protect themselves ^[1].

Which CSIRT to notify

Reports go through ENISA's platform to the relevant national Computer Security Incident Response Team (CSIRT) ^[1]. The regulation sets out which one that is, and it isn't necessarily the one in the country where the manufacturer is based.

If the manufacturer is established in the EU, the report goes to the CSIRT of the member state where it has its place of establishment ^[1]. If it has several, it's the state where it makes the main investment decisions ^[1]. If the manufacturer is outside the EU and has appointed an authorised representative, the report goes to the CSIRT of the state where the representative is based ^[1]. If there's an importer, the CSIRT of the state where the importer is established ^[1].

Submitting to the wrong CSIRT doesn't count as compliance.

No safe harbour in ongoing investigations

The deadlines count from awareness, not from certainty. That means a manufacturer can't wait until the investigation is complete before starting the clock. The early warning goes out with what is known at the time, and the final report follows within the set period.

This is the point where manufacturers used to working with less rigid timelines sometimes trip. An incident is discovered on a Friday evening. IT starts investigating. Legal wants to see the forensic report. Marketing suggests waiting until the messaging is agreed. By Monday morning, the 24-hour window has closed.

The rule doesn't bend for internal processes.

How a digital witness helps

Keep a record that stands up

Here, the thing to seal is the moment awareness begins: the first detection note, the decision to escalate and each report as it is sent to the platform ^[2].

Sealing takes a fingerprint of the record, not the content, so the detection notes and reports never leave your systems. They go to WitniumChain as fingerprints through the REST API, the SDK or the MCP server, and you get a witness ID back. The first 2,000 witnesses a month are free ^[2].

If a supervisor or an insurer later asks why the early warning went out after 30 hours instead of 24, anyone you share the record with can check that the sealed fingerprint matches the one calculated from the record now. If it matches, the record hasn't changed since it was sealed.

What it doesn't do: it doesn't show that the report was complete, that the response was adequate or that the notification went to the right CSIRT. Those are separate questions. What it does is show when each step was recorded, in a way nobody can quietly rewrite afterwards.

How it would work

1. At detection, seal a note with the time and what was seen.
2. When the decision to escalate is made, seal that.
3. As each report is submitted, seal a copy.

What this means for you

If you manufacture products with digital elements for the EU market, ask these questions now:

• When a vulnerability or incident is first detected, who records that moment and where?
• Does the person who spots it know the 24-hour rule?
• Which national CSIRT is yours, and has that been checked with legal?
• If a regulator asks when you became aware, could you show a record that hasn't been edited?

The rule has applied since September. The deadlines don't wait for procedures to catch up.

What to watch

The CRA's main requirements for products with digital elements apply from 11 September 2027, one year after the reporting rules ^[1]. That brings cybersecurity requirements, conformity assessments and CE marking. For critical products listed in Annex I, it's 11 September 2028 ^[1].

The regulation's full text, including the reporting article, is at EUR-Lex ^[1]. ENISA's unified reporting platform is at the EU's digital strategy site ^[3].