CRA: two weeks to reporting — run a rehearsal that starts from a real signal

The signal and the facts that change the decision

Cyber Resilience Act Article 14 reporting duties apply from 11 September 2026. An early warning may be due within 24 hours and the main notification within 72 hours after a manufacturer becomes aware of a covered actively exploited vulnerability or severe incident.

The legal trigger is not the mere existence of a vulnerability: the Article 14 concepts and conditions must be assessed for the covered product. The 24- and 72-hour markers run from relevant manufacturer awareness, so internal intake and escalation require reliable timestamps.

The 2026 duty precedes the general application of the main CRA rules in December 2027 and can reach products already placed on the market. Reporting every CVE creates noise and potentially incorrect statements; waiting for complete certainty can miss the deadline. The organisation needs a documented threshold, progressive updates, and separation among confirmed facts, attributions, and hypotheses.

Decision, limits, and stop condition

The rehearsal should start with an incomplete signal received through support, a researcher, a supplier, or telemetry and force the team to decide product, version, exploitation, impact, territory, clock, and content. An exercise that starts with a completed form does not test the real duty.

Reporting every CVE creates noise and potentially incorrect statements; waiting for complete certainty can miss the deadline. The organisation needs a documented threshold, progressive updates, and separation among confirmed facts, attributions, and hypotheses.

Execution and proof of completion

Execution should start by inventorying in-scope products, owners, contacts, vulnerability channels, suppliers, versions, countries, and reporting-platform access. Then, simulating out-of-hours intake, legal and technical triage, clock decision, early warning, notification, and corrective update. Closure requires timing every handoff and correcting gaps in data, authority, cover, or contact before 11 september.

The rehearsal passes when a realistic alert reaches the right owner, the trigger is decided and justified, a test submission is ready within the internal deadline, and the entire timeline can be reconstructed without oral memory.

• inventorying in-scope products, owners, contacts, vulnerability channels, suppliers, versions, countries, and reporting-platform access.
• simulating out-of-hours intake, legal and technical triage, clock decision, early warning, notification, and corrective update.
• timing every handoff and correcting gaps in data, authority, cover, or contact before 11 September.
• The rehearsal passes when a realistic alert reaches the right owner, the trigger is decided and justified, a test submission is ready within the internal deadline, and the entire timeline can be reconstructed without oral memory.