Skip to content
Declara
⌘K
compliance-owner

File the 72-hour notification

Was this page helpful?

This page reflects our reading of Cyber Resilience Act, Article 14(2) as of . It is not legal advice. Review process.

You have 72 hours from the moment you became aware of the vulnerability or incident to submit the notification — the same awareness timestamp that started your 24-hour early warning clock, not a new one starting from when the early warning was filed.

Before you start

Steps

  1. Open the case. Once the early warning is recorded, the notification is the stage on screen, with its deadline 72 hours from awareness. The timeline also shows Platform shows, the earlier time the reporting platform displays: ENISA calls that a known error, and the legal deadline is the one Declara counts.
  2. Fill in the notification. Anything the early warning already said is carried over, and what the product knows is pre-filled. Review every field; this is also where anything learned since the early warning goes. For an actively exploited vulnerability, the platform now requires when the vulnerability occurred at this stage (glossary v26a); an estimate is allowed if you say so.
  3. If one of the particular exceptional circumstances applies to a vulnerability, select it here: this is the only stage the platform offers it.
  4. Press Generate packet, copy it into the CRA Single Reporting Platform yourself, and come back. Declara does not submit to the SRP — there is no SRP API today.
  5. Enter the platform's reference, or a note saying how else it was filed, and press Mark as submitted.

What you should see

The case now shows notification_submitted. For an incident case, this is also the moment the final report's one-month clock starts — it's the only deadline in the whole sequence that doesn't run from awareness. For a vulnerability case, the final report instead waits on a fix becoming available; see File the final report for that distinction.

Related