Incident Response & CRA: The Weakest SME Domain

What Article 14 asks for

The CRA introduces a strict, layered reporting cascade for actively-exploited vulnerabilities and severe incidents — applicable from 11 September 2026, more than a year before the main CRA obligations kick in. The Commission's guidance C(2026) 5252 (27 July 2026) treats the three stages as a single deadline chain: miss the 24-hour early warning and the later filings still fall due, but so does the enforcement risk.

• 24 hours — early warning notification

  As soon as a manufacturer becomes aware of an actively-exploited vulnerability, an early warning must be submitted to the ENISA Single Reporting Platform within 24 hours.

• 72 hours — vulnerability notification

  Within 72 hours, a fuller notification must follow, including any corrective or mitigating measures already applied and their effect.

• 14 days / 1 month — final report

  A final report is due within 14 days after a corrective or mitigating measure is available for a vulnerability, or within one month after the notification for a severe incident — describing severity, impact and remediation.

• Coordinator CSIRT identified

  Each Member State designates a coordinator CSIRT under NIS2. The Commission's guidance is explicit that manufacturers must know theirs — the SRP dispatches to it. Not the same as the manufacturer's own CVD channel: they are complementary, and both must be in place — reporting has applied since 11 September 2026.

• Coordinated Vulnerability Disclosure policy

  Article 13 requires manufacturers to have a published CVD policy — the entry point for researchers and customers to report vulnerabilities responsibly. Complements the CSIRT dispatch, does not replace it.

• Product life-cycle policy

  Support periods, update timelines and end-of-life communication must be documented. 58% of microcompanies either lack a formal policy or manage it informally.