What are the main CRA reporting deadlines?

The CRA requires an early warning within 24 hours and a fuller notification within 72 hours. Final-report timing depends on whether the case is an actively exploited vulnerability or a severe security incident.

When is the final report due for a severe CRA security incident?

The final report is due within one month after the incident notification under Article 14(4)(b) is actually submitted. It should not be calculated from the theoretical 72-hour deadline when the real submission time is unknown.

🛡️ Free CRA planning tool

Cyber Resilience Act Reporting Deadline Planner

Turn the moment your team became aware of a reportable CRA event into an operational timeline: 24-hour early warning, 72-hour notification, and the applicable final-report deadline.

Article 14 timelineRuns locallyNo accountCalendar export

Classify the event

Select the Article 14 reporting path you are planning.

Reporting pathProduct / case nameInternal case owner

Set the clock anchors

Use the timestamps that Article 14 actually measures from.

Manufacturer became aware atCorrective / mitigating measure available atFor an actively exploited vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure is available.

Readiness notes

Keep the planning context beside the countdown.

Member States / market notesInternal handoff notes

Set an awareness timeThe planner will calculate the Article 14 timeline.

Early warning—within 24 hours of awareness

Main notification—within 72 hours of awareness

Final report—depends on reporting path

Next milestone—waiting for inputs

Operational timeline

What to prepare

Planning aid, not legal advice. This tool implements timing logic from CRA Article 14 and European Commission reporting guidance. It does not decide whether an event is legally reportable, whether an exception applies, or what information is sufficient for a filing.

CRA reporting obligations begin on 11 September 2026

For manufacturers covered by the Cyber Resilience Act, Article 14 reporting obligations apply from 11 September 2026. The core sequence is an early warning within 24 hours, a fuller notification within 72 hours, and a path-specific final report.

Do not reuse the 72-hour deadline as the severe-incident final-report anchor

For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure becomes available. For a severe incident affecting product security, the final report is due within one month after the Article 14(4)(b) incident notification is actually submitted. If that submission time is unknown, this planner intentionally leaves the final deadline unset.

Read the CRA reporting deadlines guide, or verify the legal text directly in Regulation (EU) 2024/2847 and the European Commission reporting guidance.