CRA Article 14. Reporting obligations of manufacturers

• (a)

  an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it, indicating, where applicable, the Member States on the territory of which the manufacturer is aware that their product with digital elements has been made available;
• (b)

  unless the relevant information has already been provided, a vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively exploited vulnerability, which shall provide general information, as available, about the product with digital elements concerned, the general nature of the exploit and of the vulnerability concerned as well as any corrective or mitigating measures taken, and corrective or mitigating measures that users can take, and which shall also indicate, where applicable, how sensitive the manufacturer considers the notified information to be;
• (c)

  unless the relevant information has already been provided, a final report, no later than 14 days after a corrective or mitigating measure is available, including at least the following:

  • (i)

    a description of the vulnerability, including its severity and impact;

  • (ii)

    where available, information concerning any malicious actor that has exploited or that is exploiting the vulnerability;

  • (iii)

    details about the security update or other corrective measures that have been made available to remedy the vulnerability.

• (a)

  an early warning notification of a severe incident having an impact on the security of the product with digital elements, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it, including at least whether the incident is suspected of being caused by unlawful or malicious acts, which shall also indicate, where applicable, the Member States on the territory of which the manufacturer is aware that their product with digital elements has been made available;
• (b)

  unless the relevant information has already been provided, an incident notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident, which shall provide general information, where available, about the nature of the incident, an initial assessment of the incident, as well as any corrective or mitigating measures taken, and corrective or mitigating measures that users can take, and which shall also indicate, where applicable, how sensitive the manufacturer considers the notified information to be;
• (c)

  unless the relevant information has already been provided, a final report, within one month after the submission of the incident notification under point (b), including at least the following:

  • (i)

    a detailed description of the incident, including its severity and impact;

  • (ii)

    the type of threat or root cause that is likely to have triggered the incident;

  • (iii)

    applied and ongoing mitigation measures.

• (a)

  it negatively affects or is capable of negatively affecting the ability of a product with digital elements to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions; or
• (b)

  it has led or is capable of leading to the introduction or execution of malicious code in a product with digital elements or in the network and information systems of a user of the product with digital elements.

• (a)

  the Member State in which the authorised representative acting on behalf of the manufacturer for the highest number of products with digital elements of that manufacturer is established;
• (b)

  the Member State in which the importer placing on the market the highest number of products with digital elements of that manufacturer is established;
• (c)

  the Member State in which the distributor making available on the market the highest number of products with digital elements of that manufacturer is established;
• (d)

  the Member State in which the highest number of users of products with digital elements of that manufacturer are located.

In relation to the third subparagraph, point (d), a manufacturer may submit notifications related to any subsequent actively exploited vulnerability or severe incident having an impact on the security of the product with digital elements to the same CSIRT designated as coordinator to which it first reported.