CRA 24-Hour Clock: When Does “Awareness” Start?
Published September 2026 by Solarc Labs
A suspicious signal should trigger prompt assessment, not an automatic reportability conclusion
Article 14 measures the 24-hour and 72-hour deadlines from when the manufacturer becomes aware of an actively exploited vulnerability or severe incident affecting the security of a product with digital elements. The Commission published final CRA implementation guidance on 27 July 2026 and says the reporting obligations apply from 11 September 2026. The guidance is non-binding, but it gives manufacturers a practical interpretation to use when preparing their process. Operationally, separate signal receipt from the awareness decision. An alert from monitoring, a researcher, a customer, a supplier or an authority is evidence that needs prompt assessment; the mere arrival of an unverified signal should not be treated as a substitute for the manufacturer’s actual assessment of the Article 14 trigger.
The key threshold is a reasonable degree of certainty after the initial assessment
The Commission guidance describes awareness as arising when, after an initial assessment, the manufacturer has a reasonable degree of certainty that a vulnerability contained in its product is being actively exploited or that a severe incident has occurred and compromised the security of the product. That is more specific than “we received an alert” and less demanding than complete forensic certainty. Build the triage around the actual product and event: identify the product and version, preserve the source of the signal, test whether the affected component or behaviour is relevant to the product, record the evidence supporting exploitation or severe-incident criteria, and name the person responsible for the awareness determination.
Do not turn the initial-assessment window into an open-ended investigation
The practical risk runs in both directions. Declaring every scanner hit or researcher email to be awareness can collapse useful triage into noise. But delaying the awareness decision until root cause, attacker identity, complete impact and every forensic detail are known can push a real case past the reporting window. The initial assessment should therefore be prompt and bounded around whether there is enough reliable evidence to reach the reasonable-certainty threshold. If the threshold is not reached, record what was checked and what evidence is still missing. If it is reached, record the awareness timestamp immediately and move the same case into the 24-hour early-warning and 72-hour notification workflow rather than starting a second disconnected record.
Record the signal, assessment and awareness timestamps separately
A defensible operating record should let another reviewer reconstruct the sequence without guessing. Keep at least the time the signal was received, the time the initial assessment began, the time the awareness threshold was judged reached or not reached, the product or versions considered, the evidence used and the named decision owner. If new evidence changes the conclusion, preserve that transition rather than silently overwriting the earlier state. Those timestamps serve different purposes. Signal receipt shows when information entered the organisation; assessment timing shows whether triage was prompt; the awareness timestamp is the point the Article 14 preparation clocks are anchored to when the responsible human concludes the threshold has been met.
Rehearse the awareness decision before the 11 September reporting start
A tabletop should not ask only whether the team knows there is a 24-hour deadline. Give the team an ambiguous signal and test whether it can identify the in-scope product, assign a prompt initial assessment, preserve evidence, reach or reject the reasonable-certainty threshold, record the awareness decision and hand the same case into the staged SRP workflow. That exposes missing ownership before a real clock is running. CRA Incident Desk is scoped to this readiness and evidence problem: one private tabletop with awareness timestamps, human triage, preparation clocks and an exportable preparation pack. It does not make the legal determination that an event is reportable, submit a notification to ENISA or a CSIRT, or certify CRA compliance. The responsible manufacturer and its advisers remain responsible for the actual legal and regulatory decision.
Primary sources
Sources used for this article
Continue the job