Mandatory from 11 September
CRA reporting process: the template you need on day one.
Anyone selling software, or devices with software, in the EU must report actively exploited vulnerabilities within 24 hours from 11 September 2026. This template turns the obligation into a procedure: who, when, where, in which words.
- Deadlines 24 h / 72 h / 14 days / 1 month with a worked example
- Decision tree “reportable?” in three questions
- Four ready-to-fill notification templates under Article 14
- User information with a text block
- Product register, SBOM checklist, case log, drill log
- DOCX + PDF, English and German, 7 pages each
79 €
€79 one-time, incl. VAT, delivered by e-mail immediately
How you receive the template
After payment you receive the template by e-mail as attachments: DOCX and PDF in English and German, usually within a minute. Enter your company, contact point and products, rehearse the procedure once, done.
Who this applies to
Every manufacturer whose products with digital elements are made available on the EU market, regardless of where the company is based. A manufacturer in Switzerland, Japan or the United States with customers in the EU is covered. The template also gives the order in which manufacturers without an EU establishment determine their CSIRT.
The seven chapters
- Roles and a contact point reachable around the clock
- Deadlines and clock times, with a worked example
- Decision tree: does it have to be reported?
- Notification templates: early warning, notification, final report
- Informing users under Article 14(8)
- Product register and SBOM checklist
- Evidence and drill log
A working aid based on Regulation (EU) 2024/2847, Articles 14 and 16, as of September 2026; not legal advice. Formats and procedures may be further specified by implementing acts. Digital content, delivered immediately after payment; by purchasing you consent to immediate performance and waive your right of withdrawal (§ 356(5) BGB). Price incl. VAT, invoice by e-mail.