CRA reporting deadlines and notification drafter

Article 14(5) calls an incident severe where it negatively affects, or is capable of negatively affecting, the ability of the product to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions — or where it has led, or is capable of leading, to malicious code being introduced or executed in the product or in a user's network and information systems.

That is your judgement to make. This tool sets out the test and does not answer it, because answering it wrongly in the direction of 'not severe' suppresses a notification that is already on a 24-hour clock.

This drafts content. It does not file anything. Article 14(7) requires notifications to go through the single reporting platform of Article 16, to the electronic notification end-point of the CSIRT designated as coordinator in the Member State of your main establishment, and to be simultaneously accessible to ENISA — and which CSIRT that is turns on facts only you hold. Article 14(6) lets that CSIRT ask you for an intermediate report, so three stages is the floor and not the ceiling. Article 14(8) is a separate duty to inform impacted users. Article 14(10) lets the Commission fix the format of these notifications by implementing act; none is reflected here, so this follows the Article's own wording. Informational only, not legal advice.