Ready Before 2027
The CRA’s first real deadline asks a practical question before the Regulation reaches full application: can a manufacturer turn reliable product-security knowledge into timely, correctly routed, user-protective action? This final chapter connects the event thresholds, two notification tracks, Single Reporting Platform, dissemination safeguards, lifecycle duties, and feedback mechanisms into one readiness judgment. The goal is not to declare a universal compliance checklist, but to show what a credible reporting operating model must be able to do on 11 September 2026 and which wider capabilities still mature toward 11 December 2027.
The minimum chain must work as one system
A manufacturer is ready for the live reporting duty only when several facts can travel together. It must identify the product with digital elements and the legal actor responsible for it. It must know whether a security observation is merely a vulnerability, whether there is reliable evidence of unauthorized exploitation, and whether an incident affects or could affect the protection of sensitive or important data or functions or create a path for malicious-code execution. It must record when the manufacturer became aware. It must then submit the right staged notification through the right route, communicate with users, support remediation, and retain enough information for later updates and supervision.
These are not independent boxes. The product identity determines whose vulnerability is being assessed. The responsible role determines who owes the duty. The event classification determines which information and final-report clock apply. The awareness record determines when the 24-hour and 72-hour limits begin. The establishment and product-availability records determine the route through the Single Reporting Platform. The remediation record determines when a vulnerability final report is due and whether users can act on the information. A weakness in any link can impair the rest even when the technical investigation is strong.
The first boundary is the product and the portfolio. The CRA covers software, hardware, remote data-processing solutions, and separately marketed components whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical connection to a device or network, subject to exclusions and interaction with other Union law. The early Article 14 duty is not reserved for newly launched products or for the important and critical categories used in conformity assessment. The transitional rule applies Article 14 to all in-scope products placed on the market before 11 December 2027.
A credible manufacturer therefore needs a portfolio view that includes older connected products, not just the current development pipeline. It needs to connect a product marketed under its name to the components and remote functions that support it. If an importer or distributor markets the product under its own name or trademark or substantially modifies it, that actor can be treated as a manufacturer. If an organization merely distributes another company’s unchanged product, it does not automatically inherit the manufacturer’s Article 14 role. The answer follows the facts of branding, design responsibility, modification, and market placement.
The second boundary is the event. A vulnerability is a weakness that can be exploited by a cyber threat; an exploitable vulnerability has practical potential for adversary use; an actively exploited vulnerability requires reliable evidence that a malicious actor has used it without permission. A product-security incident concerns actual or potential harm to the product’s ability to protect availability, authenticity, integrity, or confidentiality. It becomes severe when sensitive or important data or functions are affected or could be affected, or when malicious code has been or could be introduced or executed in the product or in a user’s network and information systems.
This sequence keeps urgency and precision together. A manufacturer should not treat every scan finding as proof of active exploitation. It should also not wait for confirmed widespread damage when reliable evidence shows unauthorized use or when the severe-incident conditions are already met. Internal severity scores can help teams coordinate, but they do not replace the statutory facts. When an exploited vulnerability also creates serious operational impact, the organization should preserve both dimensions rather than make one broad label do two legal jobs.
The third boundary is awareness. The Regulation ties the Article 14 deadlines to the manufacturer becoming aware of the actively exploited vulnerability or severe incident. The declared material does not provide one universal formula for deciding when every organization becomes aware. That makes the awareness record more important, not less. The manufacturer should preserve the source and time of the information, the product to which it relates, the evidence supporting the classification, the legal entity involved, and the escalation decision. A later investigation can refine the assessment without rewriting the starting point.
One operating model, two final clocks
Once the event is classified and awareness is recorded, the manufacturer must choose the applicable reporting track without treating the choice as permanent. The vulnerability track requires an early warning without undue delay and in any event within 24 hours. It identifies the actively exploited vulnerability and, where applicable, the Member States in which the manufacturer knows that the product has been made available. Within 72 hours, the manufacturer submits a fuller vulnerability notification unless the information has already been provided.