Reports & deadlines

From 11 Sep 2026, CRA Article 14 requires manufacturers to report actively exploited vulnerabilities and severe incidents via ENISA’s Single Reporting Platform (SRP). Resilic tracks the deadlines, drafts the content, and enforces that a human signs — it never files anything for you.

Declaring a reportable event — you own the clock

A reportable event is declared by a person, never auto-created. An exploited match from correlation surfaces a candidate; you promote it (pre-filled with the CVE and affected versions) and confirm or adjust the awareness time — the legally load-bearing timestamp that anchors the cascade. Severe incidents are declared manually.

Declared in error? Withdraw, don’t delete

An event cannot be deleted — the event and its audit trail are the evidence that you met the duty. If an event was declared in error (the vulnerability is not actively exploited after all, the incident is not severe, the wrong product was meant, it was a test), withdraw it: in the editor under Withdraw event, with a mandatory reason. Whoever may sign a notification may withdraw. The record stays, the audit trail gets a “Withdrawn” entry with person, time and reason; deadlines and reminders stop, the event no longer counts towards readiness and appears in the list under the Withdrawn view. Nothing can be signed for it afterwards. This only concerns the record in Resilic: anything you have already filed on the SRP you handle there — Resilic makes no claim about what the platform allows.

Deadlines — precise semantics

24h early warning — due 24 hours from awareness.
72h notification — due 72 hours from awareness.
Final report — the anchor depends on the kind:
- Exploited vulnerability: due 14 days after a corrective or mitigating measure is available (Art. 14(2)(c)) — not 14 days from awareness. You record the measure date; until you do, this stage has no running clock and can never be overdue.
- Severe incident: due one calendar month after the 72h notification is submitted (Art. 14(4)(c)) — not one month from awareness.

Stage deadlines are independent: missing the 24h window does not remove the 72h obligation, and a later stage can be submitted while an earlier one is overdue. Resilic emails deadline reminders as each due date approaches.

The report editor

Each stage has its own draft, with the fields the SRP’s own form asks for at that stage (the SRP field glossary v1 of 10 September 2026 — the labels in the editor follow the portal’s):

Early warning: summary, the Member States where the product is affected (where applicable) and, for a severe incident, whether unlawful or malicious acts are suspected (yes / no / unknown).
Notification: the SRP’s product name and product version (one product per notification; the free-text “affected products” stays for the fleet narrative), optional component name and EUVD ID, the summary as the SRP’s general information, cross-border impact, and the measures split as the portal splits them — corrective/mitigating measures taken and … for users. A severe incident adds the date and time the incident occurred and the initial assessment. For an actively exploited vulnerability the 72h notification can carry a request for particular exceptional circumstances (a request to delay dissemination on cybersecurity-related grounds under Delegated Regulation (EU) 2026/881) with its justification — the CSIRT decides.
Final report: additionally severity description and impact description as two narratives, then per kind — security-update details and (where available) malicious-actor information for a vulnerability; root cause and ongoing mitigation for an incident.

The editor shows the portal’s length caps next to each field (titles 255 characters, narratives 4,000, measures 2,000, malicious actor 100) and refuses to save a field that exceeds them, so an export pastes into the SRP without being cut.

Generate with AI pre-fills a draft grounded in what Resilic already knows — the CVE, affected products and deployments, KEV/CVSS data. Generated content is flagged “AI-drafted, needs review”; any edit keeps the draft in Draft.

Approval, export, audit trail

Approve requires an explicit confirmation (“I have reviewed and take responsibility…”), records who signed and when, and completes that stage of the cascade inside Resilic. Nothing is transmitted to an authority — you file on the SRP yourself.
Only an approved report can be exported. The export is a self-describing artifact (format aegis.article14.v1) whose report block uses the SRP glossary’s field names, so you transcribe field for field: productName, productVersion, componentName, euvdId, generalInformation (the summary), memberStates, unlawfulOrMaliciousActsSuspected, incidentOccurredAtUtc, initialAssessment, correctiveMeasuresTaken, correctiveMeasuresForUsers, dateCorrectiveMeasureAvailable (from the recorded measure), severityDescription, impactDescription, maliciousActorInfo, securityUpdateDetails, rootCause, ongoingMitigation and, when requested, particularExceptionalCircumstances. Empty fields are omitted. You download it and submit it on the SRP yourself.

That is the intended route, not a workaround. The SRP has been live since 11 September 2026 at portal.cra-srp.enisa.europa.eu, and ENISA provides no programming interface — its FAQ states that “no Application Programming Interface (API) will be provided at the initial release of the SRP, so notifications must be submitted through the platform interface”. Your Assigned Representative signs in with an EU Login account with multi-factor authentication, which you can create in advance; ENISA advises registering on the SRP itself only when you actually need to submit, and a pending validation by the coordinating CSIRT does not block a submission. So there is no automated submission from any third-party system, for anyone.
Every step — declared, generated, edited, approved — lands in an append-only audit trail (action, actor, timestamp): the evidence that you met the obligation, and of who signed what.

You can also record how impacted users were informed (Art. 14(8)) — via a published CSAF advisory or a described channel. There is no statutory deadline for this record, and Resilic never invents one; an open event without it shows an outstanding action, never “overdue”.

Reporting identity and Assigned Representatives

Under Settings → Reporting identity you record who appears on your exports as the notifying entity: the contact point (name, email, phone) and — for manufacturers established outside the EU — the EU representative. The export carries these in the notifyingEntity block, together with your organisation’s name.

Added to that are your Assigned Representatives on the SRP: the persons who file on the ENISA platform on your company’s behalf. The SRP knows a Primary Assigned Representative, who claims the manufacturer on the platform and invites others, and a Secondary. Both sign in with their own EU Login account with multi-factor authentication. Resilic records name and email for each — nothing more: Resilic registers nobody with ENISA and validates no association. The details appear in the export under notifyingEntity.assignedRepresentatives (primary, secondary; an unrecorded one is omitted) and on the confirmation page of a submitted notification, so it is clear who files it. The Assigned Representative is not the CRA’s authorised representative — two different roles.

Draft language

AI report drafts default to regulator-appropriate English — the ENISA Single Reporting Platform and national CSIRTs expect it. You can generate a draft in German instead via the language switch next to the generate action; the export carries whatever language the signed content is in. Security advisories work the same way: the advisory’s language is set when it is created (default English) and is carried into the CSAF document’s lang field.

Practice case: 450 machines in the field, no software bill of materials: how a manufacturer becomes able to report within days walks a manufacturer with a fielded fleet through what Article 14 requires, what has to be done anyway, and what Resilic does not solve.