Question 1

When does the 24-hour clock start?

Accepted Answer

When you become aware, which the Commission reads as reasonable certainty after a prompt initial assessment (Guidance ¶213–214). If unsure, our conservative reading is to use the earlier possible time.

Question 2

A library I use has a CVE. Do I report it?

Accepted Answer

Only if it is actively exploited in your product. Otherwise reporting it is not mandatory for you, but you handle it and inform the maintainer (Guidance ¶218; CRA Art. 13(6)).

Question 3

My product was released years ago, or its support has ended. Does reporting apply?

Accepted Answer

Yes. Article 14 applies to products placed on the market before 11 December 2027 (CRA Art. 69(3)), and in the Commission's reading it continues after the support period ends (Guidance ¶210).

Question 4

Is a small company fined for a late early warning?

Accepted Answer

Not with an administrative fine, if it is a micro or small enterprise. The duty itself remains (CRA Art. 64(10)(a)).

Question 5

Should I register on the platform now?

Accepted Answer

ENISA advises registering only when you need to submit a notification (ENISA SRP FAQ). Our suggestion: create the EU Login account with multi-factor authentication in advance, so the 24 hours are not spent on setup.

Question 6

Must I tell users publicly?

Accepted Answer

You must inform impacted users. The Commission reads this as risk-based: you may limit detailed information to affected users where publication could increase risk (CRA Art. 14(8); Guidance ¶220–221).

Question 7

Can someone file the report for me?

Accepted Answer

The manufacturer submits through its own representatives on the platform, using personal EU Login accounts (ENISA SRP FAQ). A tool or consultant can help you prepare the content.

Question 8

What if the CSIRT asks for more?

Accepted Answer

The coordinator CSIRT may ask for an intermediate report on status updates (CRA Art. 14(6)).