Reporting obligations of manufacturers
Summary
Manufacturers must notify any actively exploited vulnerability and any severe incident affecting product security to the CSIRT designated as coordinator and ENISA, via the single reporting platform, within 24 hours (early warning), 72 hours (notification), and a final report within 14 days (vulnerability) or one month (incident).
reportingactively exploited vulnerabilitysevere incidentenisacsirt24h 72h 14days
Read the full official text: https://www.cyberresilienceact.eu/regulation.html
← Article 13
Software bill of materials (Art. 13(8)/(24), Annex I Part II point 1)
Article 31 →
Technical documentation
Track CRA article 14 as evidence
eurocompliant maps this obligation to a checklist task and the evidence that satisfies it, alongside every other framework you follow.
Start free trial