Technical insights on coordinated vulnerability disclosure, CRA compliance, and product security engineering.
The CRA's reporting obligations do not switch on with the rest of the regulation. Article 14 applies from 11 September 2026, ahead of full conformity in December 2027, and it binds manufacturers the moment a product becomes actively exploited. Here is exactly when the duty begins and who it binds.
Most vulnerabilities a manufacturer handles never trigger a report to authorities. The CRA's Article 14 duty is narrow: actively exploited vulnerabilities and severe incidents affecting product security. Here is how to tell what is in scope, with worked examples and a decision framework.
Article 14 is a three-stage cascade: a 24-hour early warning, a 72-hour detailed notification, and a final report within 14 days or one month. Here is what each stage must contain, when the clock starts, and the follow-up duties that continue after the final report.
When an Article 14 event occurs, a manufacturer does not file with a single regulator. The CRA routes reports through a single platform to ENISA and the relevant national CSIRT at once. Here is how that architecture works, who receives what, and how onward notification flows.
Open Bug Bounty and CVD Portal both deal with vulnerability disclosure, but they serve entirely different purposes. One is a community-driven reporting network, the other is a regulatory compliance tool built for the European market.
The CRA's 24-hour clock is won or lost inside your own organisation, long before a report reaches ENISA. This is a practical guide to the detection sources, escalation paths, and decision authority that turn a vague signal at 2am into a filed early warning on time.
Article 14 reporting should be the visible output of a healthy product security programme, not a bolt-on. This closing post shows how reporting connects to vulnerability handling, SBOM, secure development, and post-market surveillance, so that filing a report is a byproduct of doing the rest well.
NIS2 splits coordinated vulnerability disclosure between a national CSIRT layer and an organisational layer. Here is what a compliant CVD policy is expected to contain, how the process should run day to day, and how it sets up the groundwork the CRA will require.
A note from the team at Porta Regulus BV on why CVD Portal exists, why the September 2026 Article 14 tier is permanently free, and how we separated the September 2026 and December 2027 deadlines in the product model.
A defensible three-point PERT estimate for what it actually costs an EU SME manufacturer to meet the CRA Article 14 reporting deadline on 11 September 2026. Expected cost: ~€39,700 with a 90% interval of €33,900 to €45,500.
The CRA separates vulnerability reporting from incident reporting, imposes different timelines for each, and routes notifications through ENISA and national authorities via the Single Reporting Platform. Here is what applies to your products, when it starts, and the internal processes you need before September 2026.
The CRA requires security to be integrated from the earliest stages of product development, not added at the end. Risk analysis, threat modelling, static and dynamic testing, and the translation of technical findings into compliance evidence are now engineering obligations, not optional practices.
For manufacturers with multiple products or PDE versions, CRA compliance is not a one-off project but an ongoing process. Structuring assessments by product line, using maturity scoring to track progress, and maintaining consistent, auditable evidence collection are what separate repeatable compliance from one-time checkbox exercises.
LLMs have compressed vulnerability discovery and exploit development to near-zero. From simultaneous bug discovery to 30-minute patch-to-exploit pipelines, the assumptions behind traditional CVD embargoes no longer hold.
CRA Annex VII defines the technical documentation a manufacturer must produce and maintain. Understanding which documents are required for your product class, how they relate to risk assessments and lifecycle decisions, and when they must be created or updated is essential before the December 2027 conformity deadline.
Most products with digital elements qualify for self-attestation under the CRA, but the evidence standard is not trivial. Product classification determines the route, risk assessments must be linked to essential requirements, and vulnerability handling processes must be documented before a Declaration of Conformity can be signed.
A manufacturer's guide to the four CRA conformity assessment routes: from self-assessment under Module A to notified body EU Type Examination, full quality assurance under Module H, and EUCC certification for critical products. Product classification determines which route applies.
ENISA's Head of Vulnerability Services on why the CVE program needs distributed governance, how the CRA Single Reporting Platform changes manufacturer obligations, and why handling vulnerability disclosure properly is now a competitive selling point.
Article 14 enforcement begins 11 September 2026 - for products already on market. Here's exactly what infrastructure manufacturers, importers, and distributors need in place before the deadline: VDP, triage authority, reporting cascade, and audit trail.
The CRA draws a sharp legal line between 'exploitable' and 'actively exploited' vulnerabilities - with very different consequences for each. We break down the three-tier obligation framework, the EUVD's role as authoritative reference, and the September 2026 reporting deadlines that apply to products already on the market.
The EU Cyber Resilience Act creates the first mandatory vulnerability handling framework for products with digital elements. We break down the 26 articles, the key deadlines, and the practical steps manufacturers should take today to prepare.
A step-by-step walkthrough of the full CVD lifecycle - receiving a researcher report, triaging with CVSS, coordinating with upstream maintainers, developing a fix, and publishing a CSAF advisory. Includes timeline expectations and common pitfalls.
The CRA mandates Software Bills of Materials for all products with digital elements. But an SBOM isn't just a compliance checkbox - it's the foundation for vulnerability correlation, supply chain risk management, and incident response. Here's how to get it right.
When a manufacturer discovers an actively exploited vulnerability, the CRA requires a 24-hour early warning to the relevant CSIRT. We examine how this obligation works, what triggers it, and how to build an internal process that meets the deadline every time.
Most SMEs selling into the EU market don't have a dedicated PSIRT. With the CRA enforcement deadline approaching, here's a practical guide to establishing vulnerability handling capabilities - roles, tools, processes, and the minimum viable PSIRT.
The OASIS Common Security Advisory Framework (CSAF) 2.0 is becoming the standard for machine-readable vulnerability advisories. We explain the format, its relationship to the CRA, and how CVD Portal generates CSAF advisories automatically.
New articles on CRA compliance, vulnerability disclosure, and product security engineering.
Published by CVD Portal Engineering