CRA reporting readiness: a checklist for hardware makers

Published 2026-11-11

Twenty-four hours is short. Most manufacturers can do it; what goes wrong is finding out on the day that the owner is unreachable, nobody knows which component a product uses, or nobody has an EU Login. These seven items can be prepared in advance.

1. Name an owner and a backup

Two people, with contact details that work at night. The 24 hours include weekends, so a single point of contact is a guaranteed gap.

2. Build the product inventory

List every product line sold in the EU with its firmware platform, main chipset, operating system and key third-party components. Advisories can only be matched to your products with this information.

3. Decide your vulnerability sources

Follow at least the CISA Known Exploited Vulnerabilities catalogue (KEV) and ENISA's EUVD, and decide who checks them and how often.

4. Define how awareness is recorded

The clock starts at awareness. Agree that whoever sees an advisory first records the time and source at once and tells the owner. You must be able to explain that timestamp afterwards.

5. Prepare English templates

The early warning, notification and final report each have required fields. Prepare the English wording for each stage in advance so only the specifics need filling in.

6. Get an EU Login for your authorised person

Submission needs a personal EU Login to sign in to the ENISA platform. Register and test it now, not on the day.

7. Prepare the user notice

Affected users must be told about the risk and mitigations. Decide the channel (email, website notice, app push) and the person responsible.

Watchpost can cover items 3, 4 and 5: it keeps matching exploited-vulnerability sources, records the time of a hit, and drafts the English report text per stage. It does not submit for you, and you review the content. You can also run the free 3-minute readiness check at cra.watchpost.cc.

FAQ

What should hardware makers prepare before CRA reporting?

An owner and backup, a product and component inventory, vulnerability sources, a rule for recording awareness, English templates, an EU Login for the authorised person, and a user-notice channel.

Which vulnerability sources should be monitored for the CRA?

At least the CISA KEV catalogue and ENISA's EUVD.

More guides

• CRA Article 14: the 24-hour, 72-hour and 14-day reporting steps
• CRA authorised representative: do Chinese manufacturers need one?

This article summarises the public text of the EU Cyber Resilience Act (Regulation (EU) 2024/2847) for general information. It is not legal advice; rely on the regulation itself and your own counsel.