CRA Article 14 Reporting Readiness

Readiness before a report

Before an incident occurs, the manufacturer should know which products are in scope, who can submit reports, which coordinating CSIRT receives them, and in which Member States the products have been supplied.

Coordinating CSIRT

The notification shall be submitted using the electronic notification end-point of the CSIRT designated as coordinator of the Member State where the manufacturers have their main establishment in the Union and shall be simultaneously accessible to ENISA.

Regulation (EU) 2024/2847, Article 14(7)

For an EU manufacturer, the main establishment is the Member State where cybersecurity decisions for the product are mainly taken. If that cannot be determined, the fallback is the Member State where the manufacturer has its Union establishment with the highest number of employees.

For a manufacturer with no main establishment in the Union, Article 14(7) requires the coordinating CSIRT's Member State to be determined in the following order, using the information available to the manufacturer:

1. The Member State where the authorised representative acting for the highest number of that manufacturer's products is established.
2. The Member State where the importer placing the highest number of that manufacturer's products on the market is established.
3. The Member State where the distributor making the highest number of that manufacturer's products available on the market is established.
4. The Member State where the highest number of users of that manufacturer's products are located.

Products supplied by Member State

The 24-hour early warning asks for Member States where the manufacturer is aware that the affected product has been made available. The SRP also routes information to other CSIRTs for Member States where the product is available.

• direct sales and distributor channels in the EU;
• marketplaces, app stores, and download channels used for EU users;
• importers and distributors that place or make the product available in specific Member States;
• product versions, firmware releases, cloud-dependent functions, or model variants that affect the report.

Report data readiness

ENISA describes the SRP as a single entry point. The manufacturer submits once, and the platform routes the notification to the coordinating CSIRT and ENISA. The report still depends on internal product and security data being ready.

• who is authorised to submit the notification;
• which product, version, component, or service function is affected;
• whether the event is treated as an actively exploited vulnerability or a severe incident;
• what is known, what is still being investigated, and what mitigation is available;
• which users or Member States may be affected;
• how the manufacturer will inform impacted users when Article 14 requires it.

Recognising reportable events

The conditions that make a report mandatory are explained in Vulnerability Reporting. The manufacturer needs to recognise those events quickly enough to meet the 24-hour and 72-hour deadlines.