CRA · In Practice

CRA reporting: can you respond within 24 hours, on your own?

Knowing the regulation and executing it within 24 hours — at 3 a.m. — are two different things. The four walls you hit when the manufacturer reporting duty meets the real world, and what we have been building.

Now live · CRAdleApplies 2026-09-11Basis: Reg (EU) 2024/2847, Art. 13 & 14CRA · In Practice

At a glance — the four walls in practice

1 · Time
24/72 hours run on calendar time — nights and weekends included
2 · Language & fields
Submission is in English (ENISA SRP), with dozens of fields
3 · People & sign-off
Triage, review, approve, submit — must stand before an incident
4 · Evidence & 10 years
Sealed evidence, kept 10+ years (Art. 13)

01In the previous article

In the previous article we laid out the manufacturer reporting duty that begins on 11 September 2026 — what to report, and by when. But that was the ‘what’. Once you actually start preparing, the hard part turns out to be the ‘how’. Knowing the regulation, and moving people, documents and systems within 24 hours at 3 a.m., are simply not the same thing.

Curious about the previous article? → 2026.9.11 manufacturer reporting duty — what & by when

02The four walls in practice

Close the regulation and actually start preparing, and this is where the walls begin.

1 · Time — 24/72 hours are not business days but calendar time. Whether it surfaces at night or on a weekend, the clock does not stop. And a spreadsheet does not warn you about the deadline.
2 · Language & fields — the submission portal (ENISA SRP) is in English, with dozens of fields. Which are mandatory, and what must be written in English, is hard to know internally.
3 · People & sign-off — who triages, reviews, approves and submits? By the time an incident hits, it is already too late. On-call, severity-judgment authority and an approval line must stand in advance.
4 · Evidence, and 10 years — what regulators need is proof that “we responded diligently,” and that evidence must be kept for 10 years, or the product support period, whichever is longer (Art. 13). A spreadsheet that can be edited any time, files scattered across a laptop — none of it defends you when it matters.

And the specific answers to these walls — whether your product is in scope, which CSIRT, which fields, who, and how — differ by product and legal structure. The distance between “we read the regulation” and “we can respond” is longer than it looks.

The distance between “we read the regulation” and “we can respond” — closing that distance is what we spent a long time on.

03 — So, we

Where the spreadsheet breaks,
we built a system.

Time · language · people · evidence — a single system that holds these four walls for you. From the internal process, to the 24-hour response, to sealed evidence, to 10-year retention.

TimeLanguagePeopleEvidence · 10y
what breaks in a spreadsheet
→
one systemstands firm
CRAdle
Available now
cradle.acelabs.co.kr →

On that day, your 24 hours are no longer yours alone.

Start the CRA self-check →Talk to us

This article is general information based on the public regulation Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 13 & 14 and public materials from the European Commission and ENISA; it is not legal advice or a conformity determination. Documentation/evidence must be retained for “10 years after the product is placed on the market, or the support period, whichever is longer” (Art. 13). Scope, specific obligations and deadlines require the original text, the latest official guidance, and case-by-case review. ACE LABS (ACE LABS Inc.) is not a certification body, but an independent pre-certification readiness and gap-assessment advisory. The legal reporting subject is the manufacturer.