SkyQon SkyQon
Get started free
English Français Deutsch Nederlands
Cyber Resilience Act · Article 14 · in force since 11 September 2026

Since 11 September 2026 you have 24 hours to report. Do you have a procedure?

The CRA 24-Hour Reporting Kit gives small and mid-size manufacturers of products with digital elements a complete, signable incident and vulnerability reporting procedure: a scope decision tree, the ENISA platform walkthrough, the five filing templates, user notices in four languages and a 90-minute rehearsal script. Installed in one week.

Take the free 12-question self-check Get the kit · €99 launch price

Written and rehearsed by SkyQon's PKI and EU-compliance practice. Not legal advice. 30-day procedure-or-refund guarantee.

This applies to you if all three are true

  • You place hardware with firmware, connected devices or software on the EU market under your own name.
  • You maintain or update that software yourself or through suppliers.
  • You do not have a written, tested procedure to notify ENISA and your national CSIRT within 24 hours.
The problem

Most CRA deadlines are in 2027. The one that can fine you is already live.

From 11 September 2026, Article 14 of the Cyber Resilience Act requires manufacturers to report every actively exploited vulnerability and every severe incident affecting a product with digital elements, including products shipped years ago. Early warning within 24 hours. Notification within 72 hours. Final report later. Fines up to €15 million or 2.5% of worldwide turnover.

If an exploited vulnerability in one of your products were found this afternoon, could your team answer these today?

  • Who decides that the event meets the reporting threshold, and starts the clock?
  • Who holds the EU Login with a second factor that the reporting platform requires?
  • What exactly goes in the 24-hour early warning, and which Member States must be listed?
  • Which users must be told, and with what wording?
  • What evidence shows a market surveillance authority that you did all of this on time?

If any answer is "we'd figure it out", the clock is already against you.

The solution

A one-week implementation, not a six-month project

The kit is the set of documents a 10- to 250-person company needs, written so a CTO or compliance lead can adopt them without counsel on the critical path.

  1. Day 1Run the scope and classification decision tree for each product; write the conclusion down.
  2. Day 2Adopt the reporting procedure, fill the RACI, name the lead and the deputy, sign it.
  3. Day 3Both named people create an EU Login with a second factor; pick your coordinator CSIRT; write the fallback ladder.
  4. Day 4Load the 24-hour, 72-hour and final-report templates and the product register into your ticketing system.
  5. Day 5Run the 90-minute tabletop and file the evidence log. You are now rehearsed and documented.

What is in the kit

Scope decision tree

Am I the manufacturer, is this product in scope, is this event reportable: actively exploited vulnerability versus severe incident, with the Article 15 route when unsure.

Reporting procedure and RACI

Editable, mapped to Article 14, hour by hour from T0, with the two different final-report clocks and a sign-off page.

ENISA platform walkthrough

EU Login and second factor, primary and secondary representatives, the coordinator-CSIRT choice that can invalidate a filing, and the fallback when the platform is down. Belgium's CSIRT chapter filled in.

Five filing templates

24-hour early warning (vulnerability and incident), 72-hour notification, final report for a vulnerability and for an incident, plus the intermediate and voluntary forms, field by field.

User notices in four languages

Article 14(8) notices to impacted users and to all users, in English, Dutch, French and German.

90-minute tabletop script

A timed drill with an evidence log, derived from our own rehearsal of this procedure in August 2026, so your first drill becomes your first piece of evidence.

Evidence and product register

What to keep, where and for how long, and the product register the early warning is filled from: versions, Member States of supply, support period.

Overlap matrix

CRA Article 14 next to NIS2 Article 23, DORA Article 19 and GDPR Article 33, so one event produces every notice it owes.

Disclosure policy and security.txt

A coordinated vulnerability disclosure policy template and a security.txt that passes the common checks, so a reporter can reach you and the clock starts correctly.

Free self-check

Twelve questions, two minutes

Each question names the article it comes from. Scored on this page; nothing is sent unless you ask for the written result.

The offer

The CRA 24-Hour Reporting Kit

Reporting Kit

€99launch price, first 50 companies · then €149

All nine chapters as one Word document plus an editable templates file. Delivered by e-mail within one business day of payment. 12 months of template updates as ENISA guidance changes.

30-day guarantee: if it does not leave you with a complete, signable procedure, reply to your receipt for a full refund.

Kit + live tabletop

€490one-time

The kit, plus a 90-minute drill run with your team on one of your real products, and a written findings report you can file as evidence.

Keep it alive

€49/mo

The Incident Reporting add-on in the SkyQon dashboard: the 24-hour and 72-hour clocks per incident, the platform fields pre-filled from your product register, drill records in your signed evidence chain, and a daily check that your security.txt is still there. Included in Enterprise and the NIS2 Evidence Pack.

Order, or ask a question

We confirm by e-mail within one business day and send a Paddle invoice; the documents follow on payment. EU VAT is handled by Paddle, our Merchant of Record.

We use this only to answer you and to deliver what you ordered. See our Privacy Policy.

Written by a practitioner, rehearsed before it was sold

SkyQon is an EU-based PKI and digital-trust practice working on NIS2, DORA, eIDAS and CRA evidence for Benelux organisations. This procedure was first written for our own products and drilled in August 2026; the drill found six plumbing failures in a procedure whose reasoning held, and those findings shaped every chapter. Every template names the article it satisfies. Free kits exist, and ENISA publishes its own SME self-assessment; what this one adds is the rehearsal, the Benelux chapter, the four-language notices, and a dashboard that keeps the clock and the record alive.

Questions we hear first

The CRA only applies from December 2027.
Most of it does. The Article 14 reporting obligations have applied since 11 September 2026 and, under Article 69(3), they cover products already on the market.
We buy components; we are not the manufacturer.
If you place the finished product on the EU market under your name or trademark, you are the manufacturer under Article 3(13), and an exploited vulnerability in a component you ship still triggers your duty to report.
Our supplier or distributor will handle reporting.
The Article 14 obligation sits with the manufacturer. Distributors and importers have their own, lighter duties under Articles 19 and 20.
We are too small to be checked.
Reporting runs through one central EU platform, and non-reporting becomes visible the moment a vulnerability in your product is public. The fine ceiling applies regardless of size, with some relief for microenterprises and small enterprises.
We already comply with NIS2 or ISO 27001.
Helpful, and not the same notice, platform or timeline: NIS2 reports about your operations, the CRA about your product. The overlap matrix in the kit shows what you can reuse and what is new.
Is this legal advice?
No. It is an implementation kit from a PKI and compliance practice. For contested scope questions, bring the kit to your counsel; it shortens the conversation.
Does the kit file reports for us?
No. ENISA's platform has no API and filings are made by your own assigned representative. The kit makes sure everything is ready to paste in; the dashboard add-on keeps the clock and the record.