CRA 72-hour notification: what must your team be ready to assemble?

The 72-hour stage is not just a timer. Manufacturers need product context, incident or vulnerability information, an initial assessment where applicable, mitigation actions and usable ownership before the clock starts.

Check CRA reporting readiness

Operational readiness

1. Identify the affected product with digital elements and internal product/version record.

2. Capture the nature of the actively exploited vulnerability or severe incident.

3. Record corrective or mitigating measures already taken.

4. Record corrective or mitigating actions users can take, where available.

5. For a severe incident, prepare an initial assessment of the incident.

6. Record information sensitivity where applicable and keep an evidence trail of who approved the submission.

Important distinction

Article 14 sets a 72-hour notification stage after awareness, unless relevant information has already been provided. The detailed content differs between actively exploited vulnerabilities and severe incidents.

Product truth

COMPLYKIT is a readiness and orientation tool. This page is not legal advice, a binding applicability determination, certification or a compliance guarantee. No automatic authority filing is claimed.

Prelaunch: public indexing intentionally disabled until the cleared brand and domain are configured.