Since 11 September 2026, actively exploited vulnerabilities must be reported within 24 hours.If it applies, how ready are we? Find your CRA gaps (6 questions, 2 min) →Find your CRA gaps
System 5 / 6
One person decides, spends and stops
For CEOs, founders and the person they put in charge
What it is
One named person responsible for the CRA work, with a budget and the authority to stop a release. Decisions are written down on one page.
Why it matters
Without an owner, every other system stalls at its first meeting.
It works when
Every serious risk has a name, a decision and a review date.
What the law says
The CRA places its duties on the manufacturer (Article 13), and several run on tight deadlines: an early warning within 24 hours and a notification within 72 hours (Article 14(2)), and fixes without delay (Annex I, Part II (2)). The law does not say who inside the company must decide. Naming one owner with a budget and the authority to stop a release is our recommendation, because a weekly management meeting is too slow for those deadlines.
Example: ABC Heating Systems, a fictional Danish maker of connected thermostats.
Mette Kjær
CEO
Names Jonas as the CRA owner, gives him a budget, and signs the big decisions herself, such as promising 15 years of security updates.
Jonas Brandt
Head of Engineering, CRA owner
Turns technical findings into decisions: what happened, why it matters, the options, and what he needs by when.
Anders Holm
CFO
Puts a price on each option so leadership can compare them side by side.
Line Vestergaard
Head of Sales
Makes sure the promise printed on the box is one the company can actually keep.
A small team can run this system too. Here is what it takes.
Do it yourself
Name one owner. Give them a budget line and the authority to hold a release.
Half a day of help
A half day if the founders cannot agree who holds the stop button.
Where SPS Digital Tech helps
We help you agree who owns the CRA work and set up a simple risk register they can keep.
The story behind it: The camera above the front door, From August 2016
The camera above the front door worked perfectly. For weeks it also had a second owner.
Read the storyWe will send you the step-by-step checklist we use with clients, and answer any questions about your setup.