PENTESTY · EDITORIAL ANALYSIS · · 4 min read
CRA and the 24-hour deadline: does your team know when it starts?
A platform counter does not replace the event awareness record. Organize handoffs between security, product teams and representatives responsible for reporting.
By Pentesty
The deadline has a scope, trigger and stages
According to the European Commission, covered manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements from September 11, 2026. Article 14 requires an early warning within 24 hours of awareness and notification within 72 hours of awareness, both without undue delay. The final report is due within 14 days after a corrective or mitigating measure becomes available for a vulnerability; for severe incidents, within one month after the 72-hour notification.
Map the product before discussing the form
A Brazilian business supplying software or equipment to the European market needs qualified owners to assess its role and the product's scope. A news headline does not turn every company into a covered manufacturer or every flaw into a reportable occurrence. Record the adopted reasoning and who must revisit it when product distribution or integration changes.
Connect each product to versions, relevant components, customers served and security and maintenance owners. Vulnerability triage helps connect an advisory to an asset. For reporting, add who receives exploitation reports, who assesses severity and who has authority to represent the organization.
Preserve event awareness without waiting for a complete dossier
Pentesty proposes maintaining a timeline of evidence received, its origin, time and the owners' assessment. Preserve what is needed to explain the decision, protecting sensitive data and details. Distinguish receiving a rumor, reliable information about exploitation and assessing product scope; do not retrospectively adjust timestamps to accommodate late approval.
ENISA's FAQ updated on October 15, 2026 states that the platform's current 72-hour counter uses 48 hours after early warning submission. The agency cautions that the counter does not replace the legal obligation. Keep the awareness record separate from the interface reminder.
Exercise handoffs and the absence of a key person
Use a fictional scenario with invented product versions, synthetic supplier messages and explicit times. Assess the two triggers and the information needed at each stage separately. Simulate the usual owner's absence and check whether a substitute can find evidence and continue the work. Conduct the exercise internally, without submitting false notifications to the regulatory portal.
- Triage: record what supports the assessment and which uncertainties need immediate escalation.
- Preparation: identify technical content, review and submission owners, with designated substitutes.
- Communication: connect each submitted statement to its source and preserve the version actually submitted.
- Continuity: track fixes, temporary measures and information needed for the corresponding final report.
Keep the regimes and evidence distinct
Brazil's ANPD describes separate obligations for personal data incidents. The CRA's 24-hour warning is not a general LGPD deadline. One event may require different assessments; maintain a matrix of triggers, recipients and owners, validated by someone with the appropriate legal competence for the case.
The breach allegation analysis complements the distinction between facts, statements and hypotheses. After the exercise, address the observed delay: incomplete inventory, outdated contacts or a review without a substitute. Measure whether the next team can reconstruct the decision from available records. An exercise and a pentest provide bounded evidence; they do not certify legal compliance.
Frequently asked questions
Does every vulnerability require CRA reporting within 24 hours?
The trigger discussed here is an actively exploited vulnerability or severe incident affecting product security, within the applicable scope. Finding a flaw alone does not automatically establish that assessment.
Do the 72 hours start after the early warning?
The 24-hour and 72-hour limits run from awareness of the covered event. Do not add 72 hours to the first warning; track the final report appropriate to the occurrence type separately.
Have all the main CRA requirements already started?
ENISA distinguishes manufacturer reporting from September 11, 2026 from the main requirements applying on December 11, 2027. Article 24(3) reporting obligations for open-source software stewards, a specific category defined by the CRA, also begin on that second date.
How can the process be tested without filing a real notification?
Run an internal simulation with synthetic data, designated owners and explicit times. Check evidence, personnel substitution and preparation for each stage; refer legal scope assessment to a qualified owner.
Sources and references
- European Commission: CRA reporting obligations
- ENISA: platform launch and application dates
- ENISA: platform FAQ, October 15 update
- ANPD: personal data incident reporting regulation
Original Pentesty analysis, published October 16, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.