CRA manufacturer reporting checklist: prepare the workflow before an incident happens

A useful CRA checklist starts before notification. The operational risk is losing time because nobody owns awareness, product mapping, escalation, mitigation evidence or the required follow-up stages.

Run free CRA readiness check

Operational readiness

1. Define what event creates internal “awareness” and how it is timestamped.

2. Assign a primary reporting owner and deputy.

3. Map products with digital elements to versions, markets and responsible teams.

4. Create a 24-hour early-warning intake template.

5. Create separate 72-hour fields for vulnerability and severe-incident cases.

6. Track mitigation, security updates and user-facing remedial actions.

7. Prepare the later final-report evidence path: vulnerability cases and severe incidents have different follow-up timing/content.

Important distinction

This is workflow readiness, not automatic reporting or a legal determination that a specific event is reportable.

Product truth

COMPLYKIT is a readiness and orientation tool. This page is not legal advice, a binding applicability determination, certification or a compliance guarantee. No automatic authority filing is claimed.

Prelaunch: public indexing intentionally disabled until the cleared brand and domain are configured.