CRA in October: turn 24- and 72-hour reporting into an operation

The milestone has passed

The Commission page, updated on 11 September 2026, confirms manufacturer reporting applies from that date. On 5 October, the operational challenge is no longer preparing a calendar: it is communicating while the investigation remains open.

Start with the manufacturer and product

The CRA covers connectable digital products made available on the market, with exclusions. Manufacturers include own-name sellers; Article 69 also brings earlier products into reporting. Merely using software is insufficient.

The non-binding guidance announced by the Commission on 27 July clarifies scope, substantial modifications, support and reporting. Use it to prepare questions, not replace legislation.

Establish the awareness timestamp

Article 14 distinguishes an actively exploited vulnerability from a severe incident affecting product security. This reporting is not required for every vulnerability or any incident; triage should justify the applicable trigger.

The Commission summarises two maximum limits from awareness: an early warning within 24 hours and notification within 72 hours. Both require action without undue delay; the second window does not start after the first.

In Velqory's proposed practice, record the time, timezone, person receiving the information and evidence supporting qualification. Distinguish a hypothesis still under triage from an event meeting the legal criteria. Do not use internal approval to artificially move the starting point.

If affected versions or impact scope remain unclear, create unknown fields with a specific question, owner and update time. Do not invent precision or wait for attacker attribution. Additional investigation should run alongside preparation of the available reporting information.

Prepare people, not preventive registrations

ENISA confirms the SRP has operated since 11 September. Registration guidance updated on 12 September requires EU Login with MFA, allows reporting while validation is pending, and advises SRP registration for a specific notification rather than pre-emptively.

Velqory recommends preparing contacts, internal authorisation and authentication capability before a case arises. Do not submit fictional reports to an official platform to test a checklist. Read current procedures, identify the appropriate recipient and rehearse internally using training documents.

Submission guidance distinguishes saving a draft from submitting it. Retain the identifier, confirmation and returned status; a prepared file or completed screen does not prove submission.

Action matrix for a specific case

This is Velqory's original proposal. Legal milestones come from the sources; owners and acceptance criteria are operational choices to adapt. Each row should produce a record that a deputy can consult without relying on the primary owner's memory.

Two final reports, two clocks

For a vulnerability, the final is due within 14 days of a corrective or mitigating measure becoming available; for a severe incident, one month after submission of the 72-hour notification. Previously-provided-information qualifications apply.

Velqory recommends a separate field for the event starting each final-report deadline. Whoever releases mitigation should inform the reporting owner and retain when and how it became available. Technical closure and documentary closure are different decisions.

Do not bring forward the steward regime

The Commission places steward reporting on 11 December 2027. Article 24 limits it to development involvement and incidents affecting the systems supplied for that development.

One dossier, separate assessments

The proposed process should open separate assessments for CRA, personal data and service security. Do not assume CRA reporting resolves GDPR or NIS2. This article does not determine Portuguese authorities, national obligations or the status of a particular entity.

Velqory's perspective is to reduce dependence on individuals: another team member should reconstruct the case, unknowns, decisions and receipts. Run an internal exercise and record observed gaps; do not claim compliance or effectiveness before verifying them.