Skip to content
Declara
⌘K
compliance-owner

Run an Article 14 drill

Was this page helpful?

This page reflects our reading of Cyber Resilience Act, Article 14 as of . It is not legal advice. Review process.

The first real filing is the wrong time to find out the product's legal name was never entered or nobody can log in to the reporting platform. A drill is a practice case against a made-up actively exploited vulnerability, run on the real clocks and the real report forms.

What a drill does not do

  • It sends no reminders and tells no integration: nothing reaches Slack, Teams, Jira or your webhooks.
  • It never appears on the overview, in the live case list, in the filing record, in GET /api/v1/cases, in the partner roll-up, in a workspace summary, or in a product's Annex I facts.
  • It has no evidence pack and no security advisory.
  • It never asks for a platform reference. Do not file anything on the reporting platform during a drill.

Every report packet it produces, on screen, copied or as a PDF, is headed DRILL — PRACTICE ONLY. NOTHING HERE WAS FILED.

Steps

  1. Open Cases, then press Start a drill in Practice drills. The 24-hour clock starts at that moment, on your most recently added product.
  2. Work the early warning as you would for real: the form prefills from the product and the workspace, and approvals apply if your workspace requires them.
  3. Press Record this stage as practised. Do the same for the notification.
  4. Read the Debrief, then press End the drill.

What you should see

The debrief shows how long each stage took against its legal deadline, the early-warning fields the product could have filled in and had nothing for, and what your reporting platform account still lacks. Fix those before a real one.

An ended drill stays under Practice drills for the record.

Related