CRA reporting deadlines: the reporting clock
About this app
Reporting obligations under Art. 14 of the Cyber Resilience Act in four machinery cases: register a notice, assess it, decide on reportability. From awareness the clock runs: early warning within 24 h, notification within 72 h, weekends included; plus the internal reporting process.
With explain mode: an AI tutor walks you through the app, points out what matters in the scene and answers your questions.
What Art. 14 CRA requires
Since 11 September 2026, manufacturers of products with digital elements must report two kinds of events, also for products placed on the market before: actively exploited vulnerabilities with reliable evidence of exploitation, and severe incidents. From awareness: early warning without undue delay and within 24 hours, detailed notification within 72 hours. The final report follows no later than 14 days after a fix is available for vulnerabilities, and one month after the notification for incidents. Reports go via the ENISA Single Reporting Platform.
What the app shows
A reporting clock: the ring stands for 72 hours from awareness, the mark at one third for the early warning, an outer band shows nights and the weekend. Below it a timeline with the deadline lanes, on the right three deadline cards. At the top the internal process from the CRA quick check: intake channel, registration, initial assessment, decision, notification, customer information, each with a check question.
Try it yourself
In the “Friday 4:40 pm” case a customer reports anomalies on a controller, and the assessment at 6:10 pm finds malicious code. Decide whether this is a severe incident and send the early warning. Waiting for approval on Monday at 9 am shows the deadline missed since Saturday 6:10 pm. A supplier’s notice about an unexploited flaw and a mere suspicion do not trigger a report.
Frequently asked questions
- What deadlines apply to reports under the Cyber Resilience Act?
- Early warning without undue delay, within 24 hours of awareness; detailed notification within 72 hours; final report for vulnerabilities no later than 14 days after a fix is available, for incidents no later than one month after the detailed notification.
- Does every vulnerability have to be reported under the CRA?
- No. Article 14 covers actively exploited vulnerabilities, with reliable evidence of exploitation, and severe incidents. A mere suspicion is not enough but calls for investigation without undue delay.
- Is there relief for small companies?
- Micro and small enterprises are not fined solely for missing the 24-hour early warning (Art. 64(10)). The notification itself and the 72-hour deadline remain mandatory.
- What can I try in the app?
- Play through four cases, decide on reportability, send the early warning, notification and user information at times you choose, drag the time cursor and see how nights, weekends and internal approvals affect the deadlines.
Subject: Betriebliche Weiterbildung
More from Betriebliche Weiterbildung
A VisuApp by heyprof: interactive, free in your browser, no sign-up. What is a VisuApp? · All apps