The 24-hour test: CRA reporting readiness check

From 11 September 2026, a manufacturer that becomes aware a vulnerability in its product is being actively exploited owes an early warning within 24 hours, a fuller notification within 72 hours, and a final report once a fix exists. Severe incidents run on their own version of the same schedule.

Most readiness checklists ask whether you have a policy. This one asks whether a specific named human would pick up the phone on a Saturday, and whether they could answer the question the form asks. Tick only what is true today, not what is planned.

A · Does the duty attach to you at all

If you answer no to the first two, stop. The rest does not apply.

We place a product with digital elements on the EU marketDirectly, or through a distributor, importer or reseller. Their duties are separate from yours and do not discharge yours.

That includes software we sell or license, or hardware carrying firmwarePure SaaS is largely outside scope, but remote data processing that a product needs to function is treated as part of the product.

We have a written list of which of our products this covers, with a date on itPer product, not per company. Variants, OEM relabels and regional SKUs usually each count separately.

B · Would you even find out

The clock starts when you become aware. Not when you are told officially.

A stranger who found a flaw in our product could report it to us in under two minutesFindable contact point, no account required, no support ticket queue.

We monitor for exploitation of components we ship, not just our own codeMost early warnings will be about somebody else's library inside your product.

Someone has actually sent something to that contact point in the last six monthsAn untested inbox is a rumour, not a capability.

C · Could you file inside 24 hours

A team name is not an answer. A person's name is.

One named person owns filing, and a named deputy covers themNot a team, not a role. A name, and a second name for when the first is on a plane.

Those people have EU Login accountsThe Single Reporting Platform authenticates through EU Login. The account takes minutes; noticing you need one with the 24-hour clock already running does not.

We know which national CSIRT is oursIt follows from where your EU presence sits. If you are established outside the EU, that turns on your authorised representative, which is a role in the Regulation rather than a setting on the platform.

Given a CVE this morning, we could list the affected products and versions todayIf the honest answer involves a spreadsheet and most of a day, the SBOM exists but does not work.

D · Could you prove it in year eight

The technical file outlives the support period, and usually the product.

We keep an immutable record of what each release actually shipped withA pipeline that regenerates a bill of materials on every build and stores nothing is fine for security and useless for evidence.

Someone's job description includes keeping that for ten yearsTen years after placing on the market, or the support period if longer. It outlives the team that built it.

0 / 12

Answer the questions above

Your result appears here as you tick.

Start your assessment, free →Check your Annex III/IV class first →

What this does not tell you. A high score means you could file. It says nothing about whether your products are correctly classified under Annex III, whether your technical documentation would survive a market surveillance request, or whether you will be ready for December 2027. Those are different questions, and the classification one comes first because everything else inherits it.

References Regulation (EU) 2024/2847. This is not legal advice and is not a substitute for a conformity assessment; the manufacturer remains responsible for its EU Declaration of Conformity. Your answers stay in this browser. If you leave your address, only your score, verdict and the gaps listed above are sent with it; nothing else leaves the page.