Why keep a log at all
Article 14 sets what each report contains and when it is due; it does not prescribe a case file. But the reports build on each other, the receiving CSIRT can ask for an intermediate status report (Article 14(6)), and the final report has to be consistent with what you said at 24 and 72 hours. A running log is how the person writing the final report knows what was already submitted, and how you show the timeline if anyone asks.
What to record at each stage
| Stage | Record |
|---|---|
| First signal | Where it came from (researcher, customer, threat intel, monitoring), the time it arrived, the raw report or alert, and who received it. |
| Awareness decision | When the signal was assessed, the facts that made it an actively exploited vulnerability or a severe incident, who decided, and the awareness time you are counting from. |
| Products and Member States | Affected products and versions, and the Member States where you know the product has been made available (needed for the early warning). |
| Reporting route | The CSIRT designated as coordinator you report to under Article 14(7), why, and who submitted on ENISA's platform. |
| 24-hour early warning | The submitted text, submission time, submitter and any platform reference. For incidents: whether unlawful or malicious acts are suspected. |
| 72-hour notification | The submitted text, time and reference; the general nature of the exploit or incident, corrective or mitigating measures taken, measures users can take, and how sensitive you consider the information. |
| Users informed | Who was told, when, through which channel, the exact wording, and whether a machine-readable advisory was published (Article 14(8)). |
| Fix or mitigation | When the security update or other corrective or mitigating measure became available. For vulnerabilities this starts the 14-day final-report clock. |
| CSIRT requests | Any request for an intermediate status report (Article 14(6)), your reply and when you sent it. |
| Final report | The submitted text, time and reference; severity and impact, root cause or malicious actor where known, and the corrective measures made available. |
| Sign-off | Who approved each report before submission, and any legal or management review. |
The content each report needs comes from Article 14(2) for vulnerabilities and Article 14(4) for incidents. CRA SRP fields checklist lists them per report.
A case log you can copy
CRA ARTICLE 14 CASE LOG Case ID: Track: actively exploited vulnerability / severe incident Internal case owner: Backup: AWARENESS - First signal (source, time, received by): - Assessed (time, by): - Why reportable: - Awareness time used for deadlines: SCOPE - Products and versions: - Member States where made available (as known): - CSIRT designated as coordinator and reason: SUBMISSIONS (copy the exact text submitted) - Early warning: due ____ sent ____ by ____ ref ____ - Notification: due ____ sent ____ by ____ ref ____ - Intermediate report requested? ____ sent ____ - Fix / mitigation available: ____ - Final report: due ____ sent ____ by ____ ref ____ USERS (Art 14(8)) - Who was informed, when, channel: - Wording / advisory link: - Machine-readable format used: APPROVALS - Each report approved by, when:
Common gaps
- No awareness timestamp. Without one, nobody can show the 24-hour clock was met. Work out the deadlines from it.
- Submitted text lost in a browser tab. Paste it into the log before you submit.
- The fix date not recorded, so the 14-day final-report deadline is missed.
- User communication handled by another team and never linked to the case. Informing users under Article 14(8)
- No record of who approved each report before it went out.
How long to keep it
Article 14 sets no retention period. Article 13(13) requires manufacturers to keep the technical documentation and EU declaration of conformity for at least 10 years after the product is placed on the market or for the support period, whichever is longer. Agree with your legal adviser whether case records follow the same period.
Questions people ask
- Does the CRA require an Article 14 evidence log?
- Article 14 does not use the words 'evidence log'. It sets what each report must contain and when it is due. A log is the practical way to show, later, when you became aware, why you decided the case was reportable, what you submitted and when, and what you told users.
- What is the most important entry in the log?
- The awareness time and how you reached it. The 24-hour and 72-hour deadlines run from when the manufacturer becomes aware of the actively exploited vulnerability or severe incident, so record when the first signal arrived, when it was assessed, and when and by whom it was judged reportable.
- Should the log record what we submitted on ENISA's platform?
- Yes. Keep a copy of the text submitted at each stage, the submission time, who submitted it and any reference the platform gives you. Article 14(6) lets the CSIRT ask for an intermediate report, and your later reports should be consistent with the earlier ones.
- How long should we keep Article 14 evidence?
- Article 14 sets no retention period for case records. Article 13(13) requires manufacturers to keep the technical documentation and EU declaration of conformity for at least 10 years after the product is placed on the market or for the support period, whichever is longer. Many teams align case records with that, but agree the period with your legal adviser.
- Is this the same as the vulnerability documentation in Annex I?
- No. Annex I Part II asks manufacturers to identify and document vulnerabilities and components, including through a software bill of materials, and to publicly disclose fixed vulnerabilities once a security update is available. Those requirements apply from 11 December 2027. Article 14 reporting has applied since 11 September 2026.