Since 11 September 2026, actively exploited vulnerabilities must be reported within 24 hours.If it applies, how ready are we? Find your CRA gaps (6 questions, 2 min) →Find your CRA gaps
System 4 / 6
Inbox, on-call schedule, template
For the CRA owner, whoever is on call, and the person who writes the customer notice
What it is
A security email address, a person on call, and a ready-made report, so you can warn the authorities within 24 hours when a flaw is being actively exploited.
Why it matters
This part of the CRA already applies. It started on 11 September 2026.
It works when
A test alarm on a Friday at 17:00 ends with a report ready in time.
What the law says
Since 11 September 2026, manufacturers must notify an actively exploited vulnerability via the single reporting platform: an early warning within 24 hours of becoming aware of it, a notification within 72 hours, and a final report no later than 14 days after a fix is available (Article 14(1) and (2)). The CRA also requires a contact address for reporting vulnerabilities (Annex I, Part II (6)). The inbox, on-call schedule and template are our recommended way of meeting that duty.
Example: ABC Heating Systems, a fictional Danish maker of connected thermostats.
Security researcher
Outside the company
Finds a flaw and emails security@. The message lands in a watched inbox, not the general support queue.
On-call engineer
Small on-call schedule or outside service
Picks up the report at any hour, including Friday evening, and starts the clock.
Jonas Brandt
Head of Engineering, CRA owner
Decides whether attackers are already using the flaw, and if so sends the early warning within 24 hours.
Line Vestergaard
Head of Sales
Writes the customer notice: what customers and installers can do until the update arrives. The same text goes into the report.
A small team can run this system too. Here is what it takes.
Do it yourself
Platform account, a named security contact, an on-call schedule, a half-filled report template, one drill.
Half a day of help
Someone who has filed on the ENISA platform, to check the template and sit in on the first drill.
Where SPS Digital Tech helps
We help you prepare your report templates and run a first drill before you need them.
The story behind it: Log4Shell, 23:40 on call, December 2021
23:40, on call, and a flaw rated ten out of ten.
Read the storyWe will send you the step-by-step checklist we use with clients, and answer any questions about your setup.