CRA Article 14 Reporting Kit: Lite (free)

Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents under Article 14 of the EU Cyber Resilience Act. The first report is due within 24 hours of awareness.

This free kit gives you what most teams are missing: a runbook for the first 24 hours.

What you get

• A 4-page PDF guide with the reporting clock for both tracks
• A four-question decision guide: "Do we have to report this?"
• How to choose the coordinating CSIRT, including for manufacturers outside the EU
• A set-up checklist for ENISA's Single Reporting Platform
• An editable Word template for the 24-hour early warning, with a four-timestamp clock log and sign-off

Not legal advice. Reflects ENISA's published FAQ and third-party guides as of 12 November 2026.

Need the complete process? The Full Pack adds the 72-hour notification, final-report templates for both tracks, a user advisory, three worked examples, roles and on-call guidance, and a register that works out every deadline: https://payhip.com/b/INbz2