What the 72-hour window is for
By hour 72 the team should have moved from “something reportable may have happened” to one case file: dates, product scope, current technical understanding, mitigation status, user communication, and who owns each next step. Not every fact has to be final. Do not wait for a full root-cause analysis; that belongs in the final report.
Start with the awareness time
Article 14 counts the 24-hour and 72-hour deadlines from when the manufacturer becomes aware. Record:
- awareness date and time, and who became aware;
- how the information arrived;
- why the team treated that moment as awareness, and any earlier signals reviewed;
- who approved the case timeline.
This is a workflow record, not a legal conclusion. Confirm the awareness point with counsel or a compliance adviser when it is in doubt.
Say which track you are on
The case file should say whether you are treating the case as an actively exploited vulnerability or a severe incident, and why. The content above differs by track, and so does the final-report deadline. If you are unsure, record the uncertainty and the evidence you are gathering, rather than leaving it in a chat thread.
Product and impact facts to collect
- product name and family;
- affected versions, builds, firmware, services or components;
- whether exploitation is known, suspected or still being assessed;
- security impact and user impact as currently understood;
- mitigations or workarounds available, and fixes in progress;
- open questions, each with an owner.
If something is unknown, mark it unknown and assign an owner.
Confirm the reporting route
Notifications go through ENISA's Single Reporting Platform to the CSIRT designated as coordinator. Under Article 14(7) that is the CSIRT of your main establishment in the EU. With no main establishment in the EU, the order is the Member State of the authorised representative, then the importer, then the distributor (in each case the one handling the highest number of your products), then the Member State where most of your users are. During the 72-hour window you should be confirming that route, not discovering it. Which CSIRT do you notify under CRA Article 14?
Set up the next deadline straight away
- Actively exploited vulnerability: record when a corrective or mitigating measure becomes available. The final report is due no later than 14 days after that.
- Severe incident: the final report is due within one month after the incident notification.
This is where teams lose track: the notification goes out, then the final-report clock lives in one person's memory. CRA Article 14 reporting deadlines explained · CRA Article 14 final report: deadlines and contents
Questions people ask
- What is the CRA 72-hour notification?
- The second step in the CRA Article 14 reporting chain. After the 24-hour early warning, the manufacturer submits a vulnerability notification (for an actively exploited vulnerability) or an incident notification (for a severe incident having an impact on the security of the product).
- When is the 72-hour notification due?
- Without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively exploited vulnerability or severe incident, unless the relevant information has already been provided.
- What must the 72-hour notification include?
- For an actively exploited vulnerability, Article 14(2)(b) asks for general information, as available, about the product concerned, the general nature of the exploit and of the vulnerability, corrective or mitigating measures taken, and measures users can take. For a severe incident, Article 14(4)(b) asks for general information, where available, about the nature of the incident, an initial assessment, corrective or mitigating measures taken, and measures users can take. Both should indicate, where applicable, how sensitive the manufacturer considers the information to be.
- Is the 72-hour notification the final report?
- No. For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure is available. For a severe incident, it is due within one month after the incident notification.
- Does VexRoute provide the official notification form?
- No. Notifications are submitted through ENISA's Single Reporting Platform. VexRoute's free desk helps you log the case, track the deadlines and keep your case file in one place.