CRA's 24-hour clock starts when the manufacturer becomes aware of active exploitation

The clock runs on knowledge, and knowledge arrives at the edge of a company. A support ticket with a customer's log attached will do it. So will a mail to a generic security address. Under Article 14 the trigger is the manufacturer becoming aware, and awareness is a property of the whole organisation ^[4].

The evidence standard is narrower than a vulnerability queue. What counts is reliable evidence that a malicious actor exploited the flaw without the system owner's permission; a proof of concept, a theoretical exploit path, or an appearance in a scanner feed does not by itself trigger the duty, according to the dev.to account of Article 14 ^[5]. Somebody has to make that call on the first read. The second branch is wider: a severe incident is an event that has or may have serious impact on the product's confidentiality, integrity, availability or authenticity, and the regulation covers severe incidents in the manufacturer's own environment when those directly affect product security, including a compromise of your build system ^[6].

Forty-eight hours separate the two notifications ^[17]. That is the time available to turn a customer's report of active exploitation into a list of affected products and versions with an assessed impact. It only works if the inventory already exists, which is why the preparation work is bookkeeping: products, versions, supported maintenance windows, and security updates that stay available across a defined support period ^[15].

The penalty ceiling is the higher of two figures, and which of them applies moves with company size. Below 600 million euros of turnover the fixed 15 million euro cap binds and above it the percentage does, because two and a half percent of worldwide annual turnover passes 15 million euros at 600 million euros of turnover: 15,000,000 divided by 0.025 ^[18].

Scope is horizontal. A component vendor's 24 hours start on the same trigger as the finished device vendor's. The list takes in hardware with embedded software, standalone software, IoT devices, and components that are integrated into someone else's larger system ^[12].

The tail of the process is the least specified part of the account. The two front deadlines are exact, and both of them fall inside the week of the incident. For vulnerability notifications the final report is tied to the availability of a corrective or mitigating measure, with a further window running from that point, and the dev.to write-up does not state how long that window is ^[10].

Article 14 arrived 15 months before the CRA's general application date of 11 December 2027 ^[19]. In my view the artefact worth writing first is one paragraph long: the roles whose knowledge counts as the organisation's knowledge, and the single channel they escalate to within the hour. Where no such routing exists, a report can sit unrouted until the 24 hours are gone.