Checkpoint: Can You Start the Right Clock?
The CRA reporting model becomes useful only when it can guide a judgment under incomplete information. This checkpoint connects the product boundary, manufacturer role, active-exploitation threshold, awareness point, and three-stage vulnerability clock through one bounded scenario. The aim is not to repeat definitions, but to test whether a reader can identify what is reportable, what must move first, and what remains a later question when the facts change.
A case that tests the trigger
Imagine a company that markets a network-connected building controller in several Member States. The controller includes a separately sourced authentication component. The company is the manufacturer of the finished product because it markets the controller under its own name, even though another organization maintains the component.
On Monday morning, the component maintainer forwards a researcher’s report describing a possible weakness. At this point, the report may be important, but it is not yet automatically evidence of active exploitation. The manufacturer needs to determine whether the weakness is in the product as placed on the market, whether an adversary could use it under practical conditions, and whether the report contains reliable evidence that an unauthorized actor has actually used it. The organization should preserve the report, identify the product and component, and escalate the analysis. It should not turn uncertainty into a settled fact merely because the issue sounds serious.
Later that day, the manufacturer receives corroborating information from deployed controllers showing that an unauthorized actor used the weakness against a live system without the owner’s permission. The organization now has a materially different fact pattern. The relevant question is no longer only whether the vulnerability could be exploited. There is reliable evidence of exploitation, and the vulnerability is contained in the marketed product. The manufacturer has become aware of a fact that can activate Article 14’s mandatory vulnerability track.
The clock is tied to that awareness point, not automatically to the researcher’s first message. In a real matter, the exact line can depend on the reliability of the evidence, which legal entity received it, and whether the information concerns the CRA product. Those facts should be documented. The manufacturer should not quietly choose a later timestamp simply because the later time is more convenient, nor should it treat every early suspicion as conclusive proof.
The company also checks its market records. It knows that the controller has been made available in three Member States, while its records for a fourth market are incomplete. The early warning should include the applicable Member States the manufacturer knows about. The incomplete record is a reason to improve the market-availability picture as the response develops; it is not a reason to omit known information or to wait until the map is perfect.
What moves first, and what can mature later
Once the manufacturer is aware of the qualifying active exploitation, Article 14 creates three milestones. The first is an early warning without undue delay and in any event within 24 hours.