Answers to common questions about mandatory reporting under the CRA. The answers link to current topic guidance so that deadlines, channels and legal conditions are maintained in one place.
Status on 11 September 2026: The Article 14 reporting obligation applies. In Slovakia, the preferred reporting method is through the Single Cybersecurity Information System (JISKB). Select the correct entry point for the type of event being reported through the SK-CERT route page. Reports submitted through JISKB will be forwarded to the Single Reporting Platform (SRP).
Frequently asked questions
- When does the reporting obligation start to apply? — application date, start of the clock and reporting stages.
- Must I report vulnerabilities discovered internally? — the difference between discovering a vulnerability and evidence of active exploitation.
- What if a reported vulnerability later proves not to be actively exploited? — the decision threshold, available evidence and prompt internal escalation.
- I am a small manufacturer without a security department. What should I do? — responsible people, EU Login, supporting information and help with the process.
- How is information in a report handled? — recipients, dissemination, confidentiality and the process after submission.
- Must I report if I have withdrawn the product from the market? — checking the role, product and temporal scope of Article 14.
Common practical tasks
- Submit a CRA report — SRP status, sign-in and submission workflow.
- Decide whether reporting is required — actively exploited vulnerability or severe incident.
- Check deadlines and prepare information — 24 hours, 72 hours and the final report.
- Distinguish CRA and NIS2 — one event may require two submissions.
- Report another vulnerability or concern — CVD, organisational incident or possible product non-compliance.
Official sources
The legal basis is Regulation (EU) 2024/2847, particularly Articles 14–17 and 24. ENISA regularly updates operational information on the SRP page and in the SRP FAQ.
Legal status: This FAQ is provided for orientation. It does not replace the legally binding CRA text, a decision of the competent authority or case-specific legal advice.