---
title: "EU Cyber Resilience Act FAQ"
canonical_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq"
source_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/29"
author: "Sorena AI"
description: "Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance."
published_at: "2026-03-10"
updated_at: "2026-07-16"
keywords:
  - "Cyber Resilience Act FAQ"
  - "CRA scope"
  - "CRA essential cybersecurity requirements"
  - "CRA vulnerability reporting"
  - "CRA CE marking"
  - "Cyber Resilience Act"
  - "CRA FAQ"
  - "products with digital elements"
  - "CE marking"
  - "vulnerability reporting"
---
**[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform

[Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io)

---

# EU Cyber Resilience Act FAQ

Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance.

*FAQ* *EU* *Cyber Resilience Act*

## EU Cyber Resilience Act FAQ

Straight answers to the CRA questions that decide whether a product can be placed on the EU market and what evidence must exist before launch.

This page helps orient product, engineering, security, compliance, legal, importer, distributor, and market-access reviews.

The EU Cyber Resilience Act applies horizontal cybersecurity rules to products with digital elements. This FAQ summarizes the core market-access questions: what is in scope, who carries each role, what manufacturers must build and document, when vulnerability reports are triggered, how conformity assessment and CE marking work, how long support must last, and what market surveillance authorities can check.

## Browse sub-FAQ modules

### [CRA Blue Guide Concepts FAQ | Placing on the Market, Making Available, Distance Sales](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)

CRA FAQ explaining Blue Guide market-access concepts for products with digital elements: placing on the market, making available, imports, CE marking, operator roles, online sales, stock, and testing exceptions.

- 33 items

### [CRA CE Marking FAQ | Conformity Assessment, EU Declaration, Evidence](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md)

Practical CRA CE marking answers for products with digital elements: conformity assessment, EU declaration, technical documentation, standards, software placement, and launch evidence.

- 15 items

### [CRA Component Due Diligence FAQ | Third-Party Software, FOSS, SBOMs](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)

Cyber Resilience Act FAQ on manufacturer due diligence for integrated components, third-party software, FOSS dependencies, SBOMs, vulnerability handling, and evidence records.

- 14 items

### [CRA Conformity Assessment Routes FAQ | Module A, Module B+C, Module H, Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md)

Cyber Resilience Act FAQ on when manufacturers can use module A, when module B+C or module H is required, and how important and critical products affect the route.

- 25 items

### [CRA Cybersecurity Risk Assessment FAQ | Article 13, Annex I, Updates](/artifacts/eu/cyber-resilience-act/faq/cybersecurity-risk-assessment.md)

CRA FAQ on Article 13 cybersecurity risk assessments, Annex I applicability, intended purpose, foreseeable use, technical documentation, and update evidence.

- 5 items

### [CRA Declaration of Conformity FAQ | Annex V, Simplified Declaration, CE Marking](/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity.md)

FAQ on the Cyber Resilience Act EU Declaration of Conformity: Annex V contents, simplified Annex VI wording, CE marking link, technical documentation, retention, updates, and operator duties.

- 16 items

### [CRA Economic Operators FAQ | Manufacturers, Importers, Distributors, Authorised Representatives](/artifacts/eu/cyber-resilience-act/faq/economic-operators.md)

CRA FAQ on economic-operator roles: manufacturers, importers, distributors, authorised representatives, substantial modification, traceability, and evidence controls.

- 27 items

### [CRA Essential Cybersecurity Requirements FAQ | Annex I Part I and Part II](/artifacts/eu/cyber-resilience-act/faq/essential-cybersecurity-requirements.md)

CRA FAQ on Annex I product cybersecurity requirements, vulnerability handling, secure-by-default design, risk assessment, documentation, lifecycle duties, and user information.

- 20 items

### [CRA Hardware and Software Boundaries FAQ | Product Scope, Components, RDPS](/artifacts/eu/cyber-resilience-act/faq/hardware-software-boundaries.md)

FAQ on Cyber Resilience Act hardware and software boundaries: combined products, standalone software, source code, components, remote data processing, SaaS and market-placement changes.

- 14 items

### [CRA Harmonised Standards FAQ | Presumption of Conformity, Common Specifications](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)

Cyber Resilience Act FAQ on how harmonised standards, common specifications, certification schemes, and OJ publication affect CRA conformity evidence.

- 21 items

### [CRA Important and Critical Products FAQ | Annex III, Annex IV, Conformity Assessment](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)

FAQ on CRA important and critical products, Annex III and Annex IV classification, core functionality, and conformity assessment consequences.

- 13 items

### [CRA Integrated Components and Dependencies FAQ | Third-Party Software and SBOM Evidence](/artifacts/eu/cyber-resilience-act/faq/integrated-components-and-dependencies.md)

Cyber Resilience Act FAQ on integrated components, third-party software, remote data processing, SBOM-style evidence, upstream fixes, FOSS dependencies, and manufacturer responsibility.

- 22 items

### [CRA Interplay With EU Product Laws FAQ | RED, Machinery, Data Act](/artifacts/eu/cyber-resilience-act/faq/interplay-with-other-eu-laws.md)

Official source CRA FAQ on overlap with the Radio Equipment Directive, Machinery Regulation, GPSR, Data Act, exclusions, declarations, documentation, and existing certificates.

- 12 items

### [CRA Known Exploitable Vulnerabilities at Launch FAQ](/artifacts/eu/cyber-resilience-act/faq/known-exploitable-vulnerabilities-at-launch.md)

FAQ for Cyber Resilience Act launch decisions: known exploitable vulnerabilities, CVEs, component flaws, secure-by-default settings, release gates, Article 14 reporting, and evidence.

- 14 items

### [CRA Legacy Products FAQ | Pre-11 December 2027 Products](/artifacts/eu/cyber-resilience-act/faq/legacy-products.md)

Cyber Resilience Act FAQ on products placed on the market before 11 December 2027, Article 14 reporting, substantial modification, distributor stock, spare parts, and records.

- 22 items

### [CRA Manufacturer Obligations FAQ | Article 13, Annex I, CE Marking](/artifacts/eu/cyber-resilience-act/faq/manufacturer-obligations.md)

FAQ for Cyber Resilience Act manufacturers covering Article 13 duties, risk assessment, Annex I, vulnerability handling, support periods, documentation, conformity assessment, reporting, CE marking, and evidence controls.

- 17 items

### [CRA Market Surveillance and Enforcement FAQ | Authorities, Corrective Action, Safeguards](/artifacts/eu/cyber-resilience-act/faq/market-surveillance-and-enforcement.md)

Cyber Resilience Act FAQ on market-surveillance authorities, investigations, corrective action, withdrawal, recall, safeguards, sweeps, documentation access, and penalties.

- 39 items

### [CRA Module B+C FAQ | EU-Type Examination, Conformity to Type, Notified Bodies](/artifacts/eu/cyber-resilience-act/faq/module-b-c.md)

CRA Module B+C FAQ explaining EU-type examination, conformity to type, notified-body evidence, production control, CE marking, declarations, and certificate changes.

- 32 items

### [CRA Module H FAQ | Full Quality Assurance, Notified Body Surveillance, CE Marking](/artifacts/eu/cyber-resilience-act/faq/module-h.md)

CRA Module H FAQ explaining the full-quality-assurance route, notified-body assessment, quality-system scope, technical documentation, CE marking, declarations, and records.

- 31 items

### [CRA Notified Bodies FAQ | Scope, Modules B+C and H, Certificates](/artifacts/eu/cyber-resilience-act/faq/notified-bodies.md)

Practical CRA FAQ on when notified bodies are needed, how CRA bodies are designated, what their notified scope means, and how Module B+C and Module H assessments work.

- 23 items

### [CRA Open-Source Software FAQ | FOSS Scope, Stewards, Manufacturers](/artifacts/eu/cyber-resilience-act/faq/open-source-software.md)

Cyber Resilience Act FAQ for free and open-source software: commercial activity, steward duties, manufacturer due diligence, vulnerability handling, public documentation, and user obligations.

- 40 items

### [CRA Over-the-Air Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/over-the-air-updates.md)

Cyber Resilience Act FAQ on OTA updates, automatic security updates, secure update distribution, support-period evidence, and offline update paths.

- 26 items

### [CRA penalties and fines FAQ | Article 64 fine caps](/artifacts/eu/cyber-resilience-act/faq/penalties-and-fines.md)

FAQ on EU Cyber Resilience Act Article 64 penalties: maximum fine tiers, turnover caps, national enforcement, economic operators, reporting duties, and open-source steward carve-outs.

- 17 items

### [CRA Product Families FAQ | Variants, Shared Assessments, Family Reuse, Conformity Scope](/artifacts/eu/cyber-resilience-act/faq/product-families.md)

CRA FAQ on product families, variant grouping, shared technical documentation, conformity evidence, and when cybersecurity-relevant differences need separate assessment.

- 16 items

### [CRA Products With Digital Elements Scope FAQ](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)

EU Cyber Resilience Act FAQ on products with digital elements, software, firmware, remote data processing, components, exclusions, market placement, and CRA operator boundaries.

- 35 items

### [CRA Remote Data Processing Solutions FAQ | Product Scope, Cloud and Backend Boundaries](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md)

FAQ on how the EU Cyber Resilience Act treats remote data processing solutions, manufacturer-controlled backends, third-party cloud services, SaaS, risk assessment, documentation, and user information.

- 16 items

### [CRA Reporting Obligations FAQ | Article 14, CSIRTs, ENISA, User Notices](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)

Cyber Resilience Act FAQ on Article 14 reporting for actively exploited vulnerabilities and severe incidents, including timing, CSIRT routing, ENISA access, user notices, and evidence.

- 21 items

### [CRA Secure-by-Default FAQ | Default Configuration and Annex I Controls](/artifacts/eu/cyber-resilience-act/faq/secure-by-default.md)

Cyber Resilience Act FAQ on secure-by-default configuration, automatic security updates, attack surface reduction, authentication, data minimisation, user information, and tailor-made products.

- 17 items

### [CRA Security Updates vs Functionality Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/security-updates-vs-functionality-updates.md)

Cyber Resilience Act FAQ on classifying security updates, functionality updates, support-period duties, automatic updates, user notices, and substantial-modification review.

- 24 items

### [CRA Substantial Modification FAQ | Updates, Repairs, Manufacturer Duties](/artifacts/eu/cyber-resilience-act/faq/substantial-modification.md)

Cyber Resilience Act FAQ on when software updates, repairs, spare parts, and post-market changes become substantial modifications and trigger CRA manufacturer, evidence, and conformity duties.

- 20 items

### [CRA Support Period FAQ | Expected Product Lifetime, Security Updates, User Information](/artifacts/eu/cyber-resilience-act/faq/support-period.md)

Practical CRA FAQ on how manufacturers determine support periods, disclose support end dates, keep security updates available, and document support-period evidence.

- 16 items

### [CRA Tailor-Made Products FAQ | Bespoke Products, Market Placement, Evidence](/artifacts/eu/cyber-resilience-act/faq/tailor-made-products.md)

FAQ on when a bespoke product may be treated as tailor-made under the EU Cyber Resilience Act, what the carve-out changes, and what manufacturers still need to document.

- 13 items

### [CRA Technical Documentation FAQ | Annex VII Evidence and Technical File](/artifacts/eu/cyber-resilience-act/faq/technical-documentation.md)

CRA FAQ explaining Annex VII technical documentation, risk assessment evidence, conformity assessment files, vulnerability handling records, product families, RDPS, language, and authority access.

- 19 items

### [CRA Transition Period FAQ | Entry Into Force, Application Dates, Reporting, Legacy Products](/artifacts/eu/cyber-resilience-act/faq/transition-period.md)

CRA FAQ on the transition period covering entry into force, 2026 reporting, 2027 application, legacy products, stock, customs timing, and software versions.

- 23 items

### [CRA Update Availability and Software Archives FAQ](/artifacts/eu/cyber-resilience-act/faq/update-availability-and-archives.md)

FAQ on CRA security-update availability, support-period notices, optional public software archives, historical versions, and Article 13(10) software-version limits.

- 25 items

### [CRA User Information and Transparency FAQ | Annex II Instructions](/artifacts/eu/cyber-resilience-act/faq/user-information-and-transparency.md)

Practical CRA FAQ on Annex II user instructions, support-period disclosure, vulnerability contacts, update notices, importer and distributor information.

- 17 items

### [CRA Vulnerability Handling FAQ | Support Periods, Components, Reporting](/artifacts/eu/cyber-resilience-act/faq/vulnerability-handling.md)

Practical CRA FAQ on vulnerability handling: SBOMs, remediation, coordinated disclosure, component issues, security updates, support periods, Article 14 reporting, and user notices.

- 17 items

### [Cyber Resilience Act Module A FAQ | Internal Production Control](/artifacts/eu/cyber-resilience-act/faq/module-a.md)

FAQ on when CRA Module A internal production control is available, when it is blocked, and what documentation, testing, standards, and evidence it still requires.

- 16 items

### [EU Cyber Resilience Act Core Functionality FAQ | CRA Product Classification](/artifacts/eu/cyber-resilience-act/faq/core-functionality.md)

CRA FAQ on core functionality, product boundaries, remote data processing, integrated components, ancillary functions, and software changes that affect product classification.

- 16 items

### [EU Cyber Resilience Act Repairs and Spare Parts FAQ](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)

CRA FAQ for repairs, spare parts, legacy products, security updates, substantial modification, and responsibility after product changes.

- 17 items

Browse all indexed questions: [/artifacts/eu/cyber-resilience-act/faq/items](/artifacts/eu/cyber-resilience-act/faq/items.md)

## All FAQ items

*Page 29 of 42. Showing 20 of 826 items.*

### [What does RDPS status change for CRA risk assessment and conformity assessment?](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md#what-does-rdps-status-change-for-cra-risk-assessment-and-conformity-assessment)

*Module: [CRA Remote Data Processing Solutions](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md)*

When remote processing qualifies as RDPS, it is part of the product with digital elements for CRA assessment. The manufacturer's cybersecurity risk assessment must cover the whole product, including in-scope RDPS and supporting functions.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(2)-(4), Article 31, and Annex VII ground the risk-assessment and technical-documentation obligations.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 4.1.2 states that the cybersecurity risk assessment covers the entire product, including remote data processing when in scope.
- [Draft Commission guidance on the CRA](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 187-190 explain RDPS documentation, conformity-scope delineation, and risk treatment for related cloud or infrastructure dependencies.

### [What should CRA technical documentation say about RDPS and third-party cloud dependencies?](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md#what-should-cra-technical-documentation-say-about-rdps-and-third-party-cloud-dependencies)

*Module: [CRA Remote Data Processing Solutions](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md)*

Where relevant, the technical documentation should identify whether the product has RDPS or relies on third-party cloud solutions and describe those solutions. If the same RDPS supports multiple products, it should still be declared in each product's documentation.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 31 and Annex VII require technical documentation with the data needed to assess product conformity and vulnerability-handling processes.
- [Draft Commission guidance on the CRA](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 188-190 describe expected documentation for RDPS, third-party cloud solutions, relevant system parts, and risk assessment.

### [What should users be told when CRA RDPS or cloud dependencies affect secure use?](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md#what-should-users-be-told-when-cra-rdps-or-cloud-dependencies-affect-secure-use)

*Module: [CRA Remote Data Processing Solutions](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md)*

Article 13(18) requires products to be accompanied by Annex II information and instructions that are clear, understandable, intelligible, legible, and sufficient for secure installation, operation, and use. If RDPS, cloud connectivity, account services, or backend assumptions are needed for secure use, the user information should make those conditions understandable.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(18) and Annex II set the user-information and instruction duties relevant to remote functions, support, updates, and secure use.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Sections 4.1.3-4.1.5 explain that risk-assessment assumptions and significant cybersecurity risks can need to be reflected in user information.

### [Can contracts or SLAs with cloud providers transfer CRA responsibility away from the manufacturer?](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md#can-contracts-or-slas-with-cloud-providers-transfer-cra-responsibility-away-from-the-manufacturer)

*Module: [CRA Remote Data Processing Solutions](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md)*

No. Contracts, SLAs, and provider assurances can support risk mitigation and due diligence, but the CRA product obligation remains with the manufacturer placing the product with digital elements on the market.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(1), Article 13(2), Article 13(5), and Article 13(8) place design, risk, due-diligence, and vulnerability-handling obligations on manufacturers.
- [Draft Commission guidance on the CRA](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Point 192 explains the role of SLAs, provider security verification, vulnerability-handling assurances, and cloud-provider change information.

### [If a third-party cloud provider changes its service, is that automatically a CRA substantial modification of the product?](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md#if-a-third-party-cloud-provider-changes-its-service-is-that-automatically-a-cra-substantial-modification-of-the-product)

*Module: [CRA Remote Data Processing Solutions](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md)*

Not automatically. The draft guidance says major changes in third-party cloud solutions should not by themselves qualify as substantial modification of the product where those solutions are not under the manufacturer's responsibility.

Sources for this answer:

- [Draft Commission guidance on the CRA](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Point 192 explains that third-party cloud changes are not automatically substantial modifications but still require due-diligence and risk-management attention.
- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(3), Article 13(14), and Recitals 38-40 ground continuing risk-assessment updates, production conformity, and substantial-modification context.

### [What must be reported under CRA Article 14?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#what-must-be-reported-under-cra-article-14)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

Manufacturers must report two categories once Article 14 applies: any actively exploited vulnerability contained in the product with digital elements, and any severe incident having an impact on the security of that product.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the two mandatory Article 14 triggers, the 11 September 2026 application date, and the transitional rule for products already on the market.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 5.3 confirms that Article 14 reporting starts on 11 September 2026 and applies to older in-scope products.

### [What counts as an actively exploited vulnerability?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#what-counts-as-an-actively-exploited-vulnerability)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

The CRA definition requires reliable evidence that a malicious actor exploited the vulnerability in a system without the system owner's permission.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 3(42) defines the exploitation threshold used by Article 14(1).
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 5.2 distinguishes malicious exploitation from good-faith testing and bug-bounty discovery.

### [What counts as a severe incident?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#what-counts-as-a-severe-incident)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

A severe incident is an incident affecting the security of the product with digital elements where either condition in Article 14(5) is met.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 14(5) supplies the severe-incident test; Recital 68 explains product-security impact from manufacturer process incidents.

### [When does the reporting clock start?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#when-does-the-reporting-clock-start)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

The legal clock runs from when the manufacturer becomes aware of the actively exploited vulnerability or severe incident.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 14(2) and 14(4) measure the 24-hour and 72-hour deadlines from manufacturer awareness.
- [Draft Commission guidance on the Cyber Resilience Act](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Point 195 of the draft guidance explains awareness after immediate initial assessment and reasonable certainty.

### [Does the CRA prescribe how manufacturers must detect reportable events?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#does-the-cra-prescribe-how-manufacturers-must-detect-reportable-events)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

No. The Commission FAQ says Article 14 does not prescribe how a manufacturer becomes aware of an actively exploited vulnerability or severe incident.

Sources for this answer:

- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 5.1 explains possible awareness channels and states that the examples do not require manufacturers to monitor all of them.

### [What are the deadlines for an actively exploited vulnerability report?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#what-are-the-deadlines-for-an-actively-exploited-vulnerability-report)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

Article 14(2) creates three stages.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 14(2) sets the staged reporting deadlines for actively exploited vulnerabilities.

### [What are the deadlines for a severe incident report?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#what-are-the-deadlines-for-a-severe-incident-report)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

Article 14(4) also creates three stages.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 14(4) sets the staged reporting deadlines for severe incidents.

### [What information must be ready for the early warning and 72-hour notification?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#what-information-must-be-ready-for-the-early-warning-and-72-hour-notification)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

For an actively exploited vulnerability, the early warning indicates, where applicable, the Member States where the manufacturer knows the product has been made available. The 72-hour vulnerability notification adds available information about the product, the general nature of the exploit and vulnerability, corrective or mitigating measures already taken, measures users can take, and the sensitivity of the notified information where applicable.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 14(2)(a)-(b) and 14(4)(a)-(b) specify the minimum content of early warnings and 72-hour notifications.

### [What must be in the final report?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#what-must-be-in-the-final-report)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

For an actively exploited vulnerability, the final report must include a description of the vulnerability, its severity and impact, information about the malicious actor where available, and details of the security update or other corrective measures made available.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 14(2)(c) and 14(4)(c) list the final-report content for vulnerability and incident reports.

### [Where is the notification filed?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#where-is-the-notification-filed)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

The manufacturer files via the single reporting platform established by ENISA, using the electronic notification endpoint of the relevant CSIRT designated as coordinator. ENISA receives simultaneous access through that mechanism.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 14(7) and Article 16(1) establish the single reporting platform, CSIRT coordinator endpoint, and simultaneous ENISA access.

### [Which CSIRT coordinator receives the report?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#which-csirt-coordinator-receives-the-report)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

If the manufacturer has a main establishment in the Union, the relevant CSIRT is in the Member State where decisions related to product cybersecurity are predominantly taken. If that cannot be determined, it is the Member State where the manufacturer has the establishment with the highest number of employees in the Union.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 14(7) defines the main-establishment rule and fallback order for manufacturers without a Union main establishment.

### [How does the CSIRT and ENISA flow work after filing?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#how-does-the-csirt-and-enisa-flow-work-after-filing)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

The CSIRT coordinator that initially receives the notification disseminates it through the single reporting platform to the CSIRTs for Member States where the manufacturer indicated the product has been made available. CSIRTs designated as coordinators also provide national market surveillance authorities with notified information needed for CRA tasks.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Articles 14(6), 16(1)-(3), and 17 describe CSIRT dissemination, market-surveillance sharing, ENISA operation of the platform, trend reporting, and vulnerability database entries.

### [Can sensitive vulnerability information be held back from wider dissemination?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#can-sensitive-vulnerability-information-be-held-back-from-wider-dissemination)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

Yes, but the CRA frames this as an exceptional dissemination control after notification, not as extra time for the manufacturer to file.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 16(2), 16(5), and 16(6) support delayed dissemination, exceptional vulnerability handling, and need-to-know controls where no fix is available.

### [Does the manufacturer also have to inform users?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#does-the-manufacturer-also-have-to-inform-users)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

Yes. After becoming aware of an actively exploited vulnerability or severe incident, the manufacturer must inform impacted users and, where appropriate, all users. The notice must include any risk-mitigation and corrective measures users can deploy where necessary, and where appropriate must be structured, machine-readable, and easily automatically processable.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 14(8) requires notification to impacted users and, where appropriate, all users, including mitigation and corrective measures.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 5.3 confirms Article 14(8) user communication for pre-11 December 2027 products that still fall under Article 14 reporting.

### [Does user notice always require public disclosure?](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md#does-user-notice-always-require-public-disclosure)

*Module: [CRA Reporting Obligations](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)*

No. The draft Commission guidance says Article 14(8) should be applied in a risk-based and proportionate way. It does not require public or indiscriminate disclosure in every case.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 14(8) covers CSIRT user communication if the manufacturer does not act in time; Article 17(2) covers public awareness for severe incidents.
- [Draft Commission guidance on the Cyber Resilience Act](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 198 and 199 explain risk-based, proportionate user communication and limits on indiscriminate public disclosure.

## FAQ Pagination

- Canonical index (page 1): [/artifacts/eu/cyber-resilience-act/faq/items](/artifacts/eu/cyber-resilience-act/faq/items.md)
- Page 1 rule: `/page/1` is intentionally not generated; use the canonical index markdown URL.
- Current page: 29 of 42

Pages: [1](/artifacts/eu/cyber-resilience-act/faq/items.md) | [2](/artifacts/eu/cyber-resilience-act/faq/items/page/2.md) | [3](/artifacts/eu/cyber-resilience-act/faq/items/page/3.md) | [4](/artifacts/eu/cyber-resilience-act/faq/items/page/4.md) | [5](/artifacts/eu/cyber-resilience-act/faq/items/page/5.md) | [6](/artifacts/eu/cyber-resilience-act/faq/items/page/6.md) | [7](/artifacts/eu/cyber-resilience-act/faq/items/page/7.md) | [8](/artifacts/eu/cyber-resilience-act/faq/items/page/8.md) | [9](/artifacts/eu/cyber-resilience-act/faq/items/page/9.md) | [10](/artifacts/eu/cyber-resilience-act/faq/items/page/10.md) | [11](/artifacts/eu/cyber-resilience-act/faq/items/page/11.md) | [12](/artifacts/eu/cyber-resilience-act/faq/items/page/12.md) | [13](/artifacts/eu/cyber-resilience-act/faq/items/page/13.md) | [14](/artifacts/eu/cyber-resilience-act/faq/items/page/14.md) | [15](/artifacts/eu/cyber-resilience-act/faq/items/page/15.md) | [16](/artifacts/eu/cyber-resilience-act/faq/items/page/16.md) | [17](/artifacts/eu/cyber-resilience-act/faq/items/page/17.md) | [18](/artifacts/eu/cyber-resilience-act/faq/items/page/18.md) | [19](/artifacts/eu/cyber-resilience-act/faq/items/page/19.md) | [20](/artifacts/eu/cyber-resilience-act/faq/items/page/20.md) | [21](/artifacts/eu/cyber-resilience-act/faq/items/page/21.md) | [22](/artifacts/eu/cyber-resilience-act/faq/items/page/22.md) | [23](/artifacts/eu/cyber-resilience-act/faq/items/page/23.md) | [24](/artifacts/eu/cyber-resilience-act/faq/items/page/24.md) | [25](/artifacts/eu/cyber-resilience-act/faq/items/page/25.md) | [26](/artifacts/eu/cyber-resilience-act/faq/items/page/26.md) | [27](/artifacts/eu/cyber-resilience-act/faq/items/page/27.md) | [28](/artifacts/eu/cyber-resilience-act/faq/items/page/28.md) | [29](/artifacts/eu/cyber-resilience-act/faq/items/page/29.md) | [30](/artifacts/eu/cyber-resilience-act/faq/items/page/30.md) | [31](/artifacts/eu/cyber-resilience-act/faq/items/page/31.md) | [32](/artifacts/eu/cyber-resilience-act/faq/items/page/32.md) | [33](/artifacts/eu/cyber-resilience-act/faq/items/page/33.md) | [34](/artifacts/eu/cyber-resilience-act/faq/items/page/34.md) | [35](/artifacts/eu/cyber-resilience-act/faq/items/page/35.md) | [36](/artifacts/eu/cyber-resilience-act/faq/items/page/36.md) | [37](/artifacts/eu/cyber-resilience-act/faq/items/page/37.md) | [38](/artifacts/eu/cyber-resilience-act/faq/items/page/38.md) | [39](/artifacts/eu/cyber-resilience-act/faq/items/page/39.md) | [40](/artifacts/eu/cyber-resilience-act/faq/items/page/40.md) | [41](/artifacts/eu/cyber-resilience-act/faq/items/page/41.md) | [42](/artifacts/eu/cyber-resilience-act/faq/items/page/42.md)

[Previous page](/artifacts/eu/cyber-resilience-act/faq/items/page/28.md) | [Next page](/artifacts/eu/cyber-resilience-act/faq/items/page/30.md)

*Recommended next step*

*Placement: after the FAQ summaries*

## Turn CRA FAQ answers into product evidence

Use these CRA FAQ summaries to assign scope checks, role mapping, risk-assessment evidence, vulnerability-reporting intake, conformity-assessment records, CE marking controls, support-period rationale, and market-surveillance readiness tasks.

- [Open Assessment Autopilot](/solutions/assessment.md): Convert CRA scope, role, support-period, and conformity questions into evidence requests and review tasks.
- [Talk through CRA readiness](/contact.md): Review product boundaries, launch blockers, vulnerability-handling evidence, and market-access records with the Sorena team.


---

[Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md)

(c) 2026 Sorena AB (559573-7338). All rights reserved.

Source: https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/29.md