Cyber Resilience Act: must the manufacturer report?
cra_reporting_checkRead-onlyIdempotent
Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art. 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847), in force since 11 September 2026: whether a report is due, the 24-hour, 72-hour and final report deadlines, where to report, and informing users.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| event | Yes | actively_exploited_vulnerability: reliable evidence that a malicious actor exploited it; severe_incident: an incident affecting the product's security | |
| malicious_code | No | Severe incident test, Art. 14(5)(b): it led or can lead to malicious code in the product or in users' systems | |
| is_manufacturer | No | Develops or manufactures the product, or has it designed or made, and markets it under its own name or trademark | |
| product_with_digital_elements | No | Software or hardware product (and its remote data processing) made available in the EU whose intended or foreseeable use includes a data connection to a device or network (Arts. 2(1), 3(1)); some products under sector laws, such as medical devices and vehicles, are excluded (Art. 2(2)-(4)) | |
| affects_data_or_functions_protection | No | Severe incident test, Art. 14(5)(a): it harms or can harm the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions |