ENISA single reporting platform: the CRA clocks

A manufacturer of a product with digital elements that learns of an actively exploited vulnerability, or of a severe incident affecting the product’s security, reports it through ENISA’s single reporting platform, starting with an early warning within 24 hours. This page gives the rule from the legal text, then what Jira does by itself, then what Dueline does.

What the CRA says

Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847) has applied since 11 September 2026. Reports go to the coordinating CSIRT of the manufacturer’s main establishment and to ENISA, through the single reporting platform (Article 14(1), (3) and (7)).

For an actively exploited vulnerability:

• an early warning within 24 hours of becoming aware, naming the Member States where the product is known to be made available;
• a notification within 72 hours, with the product, the nature of the exploit and the vulnerability, the measures taken and those users can take;
• a final report 14 days after a corrective or mitigating measure is available.

For a severe incident affecting the security of the product:

• an early warning within 24 hours, saying whether it is suspected of being caused by unlawful or malicious acts;
• a notification within 72 hours with an initial assessment;
• a final report one month after the notification.

The coordinating CSIRT may ask for an intermediate report in either case.

What Jira does by itself

Jira tracks the vulnerability or the incident as a work item, with fields and links. Its Due date holds a date, not a time, so “24 hours from becoming aware” does not fit it, and the final report of a vulnerability starts from a fix that may not exist yet. Which of the two cases a work item is, and what the article asks each report to hold, stay outside Jira.

What Dueline does

Dueline is our app. Qualify asks when you became aware and which case it is. It lists the early warning, the notification, the intermediate report on request and the final report. The final report of a vulnerability says it waits for a fix; press Fix available when one is, and its 14 days start. A severe incident’s final report starts when you record the notification as sent. Each report shows what the article asks it to hold and links the rule on EUR-Lex.

One event can start several rules: an exploited vulnerability in a product that leaks personal data runs CRA and GDPR together, and Dueline lists both. Dueline files nothing on the platform: you do, then record it. The assessment is yours, and national law may add to it.

Try the dates in the free deadline calculator. More in How deadlines are counted.

See also GDPR breach notification. Back to Dueline.