Cyber Resilience Act · Team resource

CRA checklist: prepare for 24- and 72-hour reporting

A working resource for teams placing software or connected devices on the EU market. Walk through it with the product security owner, technical team and representative who submits notifications.

· AWARELY Editorial

From 11 September 2026, Article 14 applies to manufacturers of products with digital elements within CRA scope, including products already placed on the market. Scope depends on the product and the organisation’s role; using software does not make you its manufacturer.

Deadlines start when the manufacturer becomes aware

Submit the early warning and notification without undue delay. The 72-hour deadline starts at the same point as the 24-hour deadline.

24 hours

Early warning

For an actively exploited vulnerability or severe incident affecting the security of the product.

72 hours

Notification

Available information about the product, event, assessment and measures taken or recommended.

14 days / one month

Final report

Vulnerability: no later than 14 days after a corrective or mitigating measure becomes available. Severe incident: within one month after the 72-hour-stage notification.

Source: Article 14 of the regulation

12 steps for preparation and response

Tick completed steps for this session. Ticks reset on reload and show checklist progress, not a compliance score.

0 / 12 steps completed

1. Prepare: product, owner and access

2. Assess: signal, evidence and impact

3. Notify: authorities and users

4. Follow through: final report and improvement

Frequently asked questions about CRA preparation

Must every CVE be reported?

No. Mandatory reporting concerns actively exploited vulnerabilities and severe incidents affecting product security. For a third-party component, assess applicability in the product; the Commission FAQ excludes cases where the vulnerability cannot be exploited in that product.

Does Monitor submit CRA notifications?

Monitor supports internal monitoring, prioritisation and documentation. Official notifications go through the SRP. At launch, ENISA states that the SRP has no notification-submission API.

Is buying a monitoring tool mandatory?

Article 14 establishes a reporting obligation upon awareness. It does not require buying a product or a two-hour scanning cycle. This checklist proposes organisational steps for the team.

When do the other CRA requirements apply?

The main requirements apply from 11 December 2027. The specific Article 24(3) duties for open-source software stewards also start then. Do not confuse that category with a commercial manufacturer using open-source components.

Put vulnerability information to work

Awarely Monitor brings public sources, prioritisation, owners and evidence into the internal workflow. The team determines scope and reportability and submits notifications through the SRP.

Explore Awarely MonitorRead the full guide

Sources and updates

Legal requirements and platform instructions take precedence. This checklist is an editorial planning resource, not the official reporting form.