Article 14 readiness
When does the CRA 14-day final-report clock start?
For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure is available, so the clock is tied to your release rather than to the first alert. The gap is a clear definition of measure available and a release record that proves the date.
Source: Regulation (EU) 2024/2847, Article 14. Operational readiness guidance about Regulation (EU) 2024/2847 — not legal advice or certification.
What VulnBrief does with this
The paid pack asks for the related facts, shows them back on an attestation screen, and then generates operational artifacts only from what you confirmed. Missing owners or evidence sources stay in the gap register.
Related intake fields: final_report_owner, release_process, evidence_locations.
Build the product-specific version
Get the runbook, notification drafts, evidence register, vulnerability-intake policy, and tabletop drill for one product. Flat $3,999, one time. Not legal advice, not certification.
Start the attested intake →