Published 2026-09-05

CRA reporting readiness: a product response exercise

Rehearse ownership, awareness evidence, impact decisions, review and official portal handoff.

Know what triggers reporting

The European Commission states that CRA reporting obligations apply from 11 September 2026; the main obligations apply from 11 December 2027. ENISA identifies two reportable event categories: actively exploited vulnerabilities and severe incidents affecting product security. These require product-specific assessment. A scanner finding by itself is not the whole reporting decision.

Choose one supported release

A practical preparation step is a tabletop exercise on one supported release. Use synthetic information, nominate the people involved, and mark the entire exercise as a simulation.

Record awareness and ownership

Start by identifying who receives an initial signal and records the original awareness evidence. Preserve the time and its basis. Ask who decides the event category, which product releases need investigation and which customers or markets may be affected.

Rehearse the handover

Rehearse the handover: who prepares the notification, who checks it and who uses the official platform? ENISA recommends preparing EU Login with multi-factor authentication. Its 4 September 2026 FAQ advises registering and validating the reporting organisation when a notification is needed. Check the current guidance and nominate a backup; do not assume every event shares the same final-report trigger.

Preserve the submission record

Finally, distinguish preparation from submission. Downloading a file or approving an internal report is not a receipt from the authority. For a real submission, retain the official confirmation and the exact material that was submitted. For this exercise, do not send synthetic reports to the authority.

Turn gaps into actions

Write down what stopped the exercise: an unclear owner, missing release inventory, unavailable evidence, unresolved routing or no nominated representative. Give each gap an owner and a next action.

Prepare with Conformesh

Conformesh provides workspaces for release-linked evidence, decisions and reporting preparation. It supports the manufacturer's process; it is not the official reporting platform or a certification service.

European Commission: Cyber Resilience Act · ENISA: Single Reporting Platform FAQ (checked 5 September 2026)

Explore the worked example · Check CRA readiness