CRA guides
Guides to EU CRA Article 14 reporting for hardware manufacturers outside the EU.
CRA Article 14: the 24-hour, 72-hour and 14-day reporting steps
Under EU CRA Article 14, manufacturers must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability. This guide covers the three deadlines, who receives reports, and what each stage contains.
CRA authorised representative: do Chinese manufacturers need one?
What an authorised representative is under the EU CRA, whether it is mandatory, how it differs from an importer, and why it does not replace Article 14 reporting.
CRA reporting readiness: a checklist for hardware makers
Seven things hardware manufacturers should prepare before CRA Article 14 reporting hits: owner and backup, product inventory, vulnerability sources, awareness log, English templates, EU Login and user notices.
This article summarises the public text of the EU Cyber Resilience Act (Regulation (EU) 2024/2847) for general information. It is not legal advice; rely on the regulation itself and your own counsel.