When the reporting obligation kicks in, are you ready?
CRA Hotline guides you through reporting actively exploited vulnerabilities and severe incidents to the authorities, from the first call to the submitted notification.
A yearly subscription. Ready before you need it.
Prepare once, and when the moment comes you already know who to call and what to do.
- Documents and templates that meet CRA requirements, to manage the reporting process.
- An expert on the hotline who analyses and assesses the case with you.
- The notification to the authorities, prepared and submitted on your company’s behalf.
How it works, in three steps.
Activate the service
Get ready-to-use documents and templates that meet CRA requirements, to manage the reporting process.
Call CRA Hotline
An expert is available to analyse and assess the case together with you.
We handle the notification
We prepare the notification and submit it to the competent authorities on your company’s behalf.
One call. All the support you need for CRA reporting.
When every hour counts, there is no time to work out from scratch what to write and where to send it. With CRA Hotline you have an expert on the phone, and the notification prepared and submitted for you.
On your own, under pressure
- Working out whether the obligation really applies
- Gathering the technical information
- Finding the right channel and form
- Writing the notification while you handle the emergency
With CRA Hotline
- Ready-to-use, CRA-compliant documents and templates
- An expert assesses the case with you
- We prepare and submit the notification
What you must report, and when.
The Cyber Resilience Act requires manufacturers to report two kinds of events. The clock starts when you become aware of them, not when you are ready.
Actively exploited vulnerabilities
A flaw in your product that someone is already exploiting without permission.
Severe incidents
An event that compromises the security of the product, or of the data and functions it protects.
Products with digital elements
Hardware and software on the EU market, including products already on sale.
Frequently asked questions
Who has to submit the notification?+
The manufacturer of the product with digital elements. Importers and distributors who discover a vulnerability must inform the manufacturer without undue delay.
When is a vulnerability “actively exploited”?+
When there is reliable evidence that someone has exploited it in a system without the owner’s permission. A theoretical risk is not enough: it has to be assessed case by case, and it is one of the first things we look at with you on the hotline.
Where does the notification go?+
To the single reporting platform run by ENISA, which forwards it to the CSIRT designated as coordinator in the Member State where your company has its main establishment.
Does it apply to products already on the market?+
Yes. From 11 September 2026 the reporting obligations apply to all products in scope of the CRA, including those placed on the market before December 2027.
Do the deadlines pause at weekends?+
No. The CRA sets them in hours from the moment you become aware. That is why it pays to know in advance who to call and what to write.
Does the service replace our team?+
No, it works alongside it. We analyse the case with you, and prepare and submit the notification on your behalf.
Activate CRA Hotline before you need it.
Email us: we will explain how the subscription works and how to activate it for your products.
