CRA reporting starts 11 September: make the first 24 hours less improvised

The first-hours check

From 11 September 2026, CRA reporting obligations start applying to manufacturers for actively exploited vulnerabilities and severe incidents affecting product security. The early warning can be due within 24 hours of becoming aware.

That makes the first operational question very concrete: who records awareness, who performs the human reportability assessment, who decides the reporting path, and where is the supporting evidence collected?

The useful preparation is not to automate the legal decision. It is to make the handoff and evidence trail explicit before a real incident.

A free synthetic tabletop is available here: https://cra-incident-desk.solarclabs.com/

The useful preparation is explicit ownership: record when the team became aware, route the case to human triage, preserve the first evidence, and rehearse the handoff before an incident starts the clock. This is preparation support, not an automated legal decision or regulatory submission.