What the CRA requires of you, and what Declara does about it

If you're reading this under deadline pressure, start with File an initial Article 14 report instead. This page is for understanding the shape of the obligation, not filing one right now.

The obligation, in three deadlines

From 11 September 2026, if you manufacture a product with digital elements, the CRA requires you to report two kinds of events to your CSIRT and to ENISA, simultaneously, through a single reporting platform (the SRP):

• an actively exploited vulnerability in your product
• a severe incident having an impact on the security of your product

Both follow a staged timeline, but the final stage differs by event type:

Sources: Cyber Resilience Act, Article 14, ENISA CRA Single Reporting Platform FAQ — both checked 2026-09-13.

The clock starts at awareness, not at any action you take in Declara. Uploading an SBOM or opening a case doesn't start it, and forgetting to record an early awareness timestamp doesn't stop it.

What Declara automates

• The clock math. Once you record when you became aware, Declara computes each deadline and shows a live countdown per case.
• Matching your inventory to known vulnerabilities. Your SBOM is matched against six feeds continuously: NVD, OSV, GHSA, CISA KEV, ENISA's EUVD and EPSS.
• Drafting the report packet. The fields each stage requires are assembled from your case and product data into one packet — a page you can read and a PDF you can attach elsewhere.
• A verifiable record. Every action on a case is written to a hash-chained audit log you or an auditor can independently verify.
• Telling your customers' tooling. A vulnerability case can draft a CSAF 2.0 security advisory, and a product's triage decisions can be exported as VEX.
• The written part of December 2027. A per-product record of the Annex I requirements and risk assessment, a technical file drafted from it, and substantial-modification decisions.

What stays yours

• Deciding you're obligated at all. Declara's tiering (A/B/C) tells you whether a match looks worth acting on; it is not a legal determination that a vulnerability is "actively exploited" or an incident is "severe." That judgment is the triage step, and it's yours.
• Filing. The SRP has no API today — you copy the generated packet into its own web form yourself. Declara gets you to the form ready; it doesn't submit for you.
• Correcting a mistake. A filed stage stays as it was filed in Declara. You correct the notification on the SRP, which keeps it editable until the final report, and record the correction and the CSIRT's status against the stage. See Track a filing.
• Everything Declara doesn't know about your product. Dependency depth in your SBOM is a hint about whether a component is one you chose or one you inherited — read from the SBOM's own graph, not proof of reachability.

Beyond the clock: the obligations around it

Article 14 is the deadline. Article 13 and the annexes set the duties a manufacturer carries for the whole support period. For each, here is what Declara does and what stays yours.

Due diligence on third-party components — Art. 13(5)

• Declara does: lists each package your supported versions ship, with what it can see about it (versions, licences, suppliers, matched and exploited advisories, dependency depth), keeps your review beside it, and marks a review stale when its date passes or an exploited advisory appears after it. See Review a third-party component.
• Stays yours: the review itself, and whether a component is fit to ship. Maintenance status and the last release are entered by you; Declara does not fetch them.

Reporting a vulnerability upstream — Art. 13(6)

• Declara does: keeps the record of who you told, when, and what came of it, checks the advisories it holds for an existing report, and notes when you shared a fix. See Report a vulnerability upstream.
• Stays yours: sending the report. Declara sends nothing to a maintainer, and its duplicate check cannot see private trackers.

The support period — Art. 13(8)

• Declara does: keeps the end date, the factors you answered and your reasoning, flags a period under five years, warns you 90, 30 and 7 days before it ends, and drafts the end-of-support notice. See Record a product's support period.
• Stays yours: deciding the period, and telling your users. Matching stops for a version once its support ends.

Information and instructions for users — Art. 13(18), Annex II

• Declara does: drafts the Annex II items from what it already holds, shows each item's source and leaves every item it cannot fill visible. See Draft the user information.
• Stays yours: the final text, its translation (the draft is in English only), and shipping it with the product.

Answering a market-surveillance authority — Art. 13(22), Annex VII

• Declara does: collects what it holds about one product into a verifiable pack, with a verification code and a SHA-256 hash anyone can check on /verify. See Answer a market-surveillance request.
• Stays yours: the reply to the authority, and anything the request asks for that Declara does not hold. The pack is not a conformity assessment.

No known exploitable vulnerabilities at release — Annex I Part I(2)(a)

• Declara does: answers, per version, whether a component in its SBOM matches an advisory that is known to be exploited or a Tier A match and that nothing clears. The answer is in the app and through the release gate API. It is a signal, not a conformity verdict.
• Stays yours: the release decision. A pass does not mean the product meets Annex I, and releasing over a blocked is a decision you record in the app, with a reason.

Technical documentation and the declaration of conformity — Annexes V, VI and VII

• Declara does: drafts the technical file (Annex VII) and the declaration of conformity (Annex V) from your records, leaving placeholders visible, and shows the simplified declaration (Annex VI) on the product's Trust Center once you confirm the declaration you issued.
• Stays yours: the conformity assessment, and signing the declaration. Declara does not check the document and makes no claim of conformity on the page.

Why this design, not a fuller-automation one

Declara doesn't submit to the SRP automatically because there isn't an API to submit to today — a platform limitation, not a product choice. Where the product does have a choice — like not silently closing an alert when a VEX statement arrives after you've already opened a case on it — it errs toward a human seeing the change rather than the system deciding quietly. See Why VEX suppresses a match but never an open alert.

Related

• The reporting clock, explained
• Shared responsibility: Declara vs. you
• File an initial Article 14 report
• Every feature on one page