Operational guides for the Article 14 reporting duty that has applied since 11 September 2026: the ENISA platform, the 24-hour early warning, choosing the CSIRT, third-party components and informing users.
Practical steps for notifying through ENISA's Single Reporting Platform: EU Login accounts with MFA, primary and secondary representatives, when to register, the fields required at each stage, what happens after submission, and the lack of an API.
How to organize to meet the CRA's 24-hour, 72-hour and final report deadlines: when awareness starts, what each stage must contain, intermediate reports, delays CSIRTs may apply, SME relief from fines on the 24-hour deadline, and one notification per event.
How to identify the CSIRT designated as coordinator for CRA notifications: main establishment where cybersecurity decisions are taken, the fallback rules, the order for manufacturers without an EU establishment, and what happens if the wrong CSIRT is chosen.
What to do when a vulnerability sits in a component you integrate: when it must be notified under Article 14, voluntary reporting, reporting upstream to the maintainer and sharing fixes, and due diligence that makes this manageable.
What manufacturers must tell users and when: informing affected users of incidents and mitigations, public disclosure of fixed vulnerabilities and justified delays, advisories with free security updates, and the European vulnerability database.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.