Questions, answered

Specific questions about EU CRA Article 14 reporting, answered directly and sourced to ENISA, the Commission or EUR-Lex. Where the answer is genuinely unsettled, the page says so.

When Grype, Trivy or Dependency-Track turns up something in your product that's actually being exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof of when you knew and what you filed. You submit it yourself: a filing is a legal statement by you, not by a tool, so craclock hands you the finished text instead of sending it for you.

• A CVE in a dependency I ship. Do I have to report it?

  Not automatically. The trigger isn't "a CVE exists," it's reliable evidence someone is actively exploiting it in your product specifically. If Grype, Trivy or Dependency-Track flags a CVE in a library you ship but nothing shows it's being exploited through your product, the European Commission's own CRA guidance says that isn't reportable, even though the CVE itself is real and patchable. Whether your product is actually exploitable through that dependency, and whether anyone has actually exploited it there, is a judgment call you make on the evidence in front of you (a customer report, a threat-intel alert, your own logs); the scanner finding by itself doesn't settle it.

• Assigned Representative or Authorised Representative?

  They're different jobs that happen to share an abbreviation. Your "authorised representative" is a formal EU compliance role: someone with a written mandate to hold your paperwork and deal with regulators if asked. Your "Assigned Representative" is just whoever you register to actually click submit on ENISA's reporting platform, a completely separate, platform-specific role the law itself never names. In practice, it's the Assigned Representative, not the authorised representative, who ever touches an Article 14 filing, and nothing in the rules stops the same person from holding both roles, though nothing requires it either.

• I am not established in the EU. Who reports, and to which CSIRT?

  You still have to report it, even with no EU office: nothing shifts that job onto your reseller, importer, or EU representative. What changes is only which national team (your CDaC, the specific one you notify) you report to. If you have no main base in the EU, work down this order to find it: first wherever your EU representative handles the most of your products, then your biggest importer, then your biggest distributor, and only if none of those apply, wherever you have the most users.

• Does emailing my national CSIRT satisfy Article 14?

  No. The law requires you to submit through ENISA's own reporting platform (the SRP), not through whatever channel is fastest. An email to your national cybersecurity team, however prompt, doesn't count, and it doesn't stop either deadline clock. Keep talking to that team for other things, like coordinating a disclosure or getting help during an incident, but the SRP submission still has to happen, even if the platform was down when you first tried and you emailed them instead.

• When does the 14 day final report clock actually start?

  For an actively exploited vulnerability, your 14-day final report clock doesn't start until you've actually shipped a fix, not when you found out and not when you filed the 72-hour notification. For a severe incident, it works differently: the clock starts one month after you submit that 72-hour notification, whether or not you've fixed anything yet.

• Actively exploited vulnerability or severe incident? Which one am I filing?

  File an Actively Exploited Vulnerability (AEV) notification when a scanner, a threat-intel alert or your own logs give you reliable evidence someone is actively exploiting a specific flaw in your product, whether or not it's caused any damage yet. File a Severe Incident (SI) notification when something has actually compromised your product's data or let in malicious code, even if the root cause wasn't a vulnerability at all, for example a stolen credential or a compromised build step. None of the ENISA and European Commission guidance checked for this page says what to do when a single event fits both categories at once, so that overlap case is genuinely unresolved.

• What is a CDaC and how is mine chosen?

  A CDaC ("CSIRT Designated as Coordinator") is just the specific national cybersecurity team you have to send your Article 14 reports to, out of all the teams across the EU. Which one is yours isn't a choice: it's picked by an ordered test, first by where your company is mainly based, then by employee count, and if you have no EU base at all, by your representative, importer, distributor or user count, in that order.

• What is PEC, when can I use it, and who decides?

  PEC is a flag you can set on a 72-hour notification for an actively exploited vulnerability, letting you hold back the full details from wider circulation for a while. You can only use it when one of three specific things is true: the exploitation is confined to one EU country, sharing the details more widely would itself cause harm, or wider sharing would create an immediate high security risk. And it isn't your call alone: your CDaC (the national team you reported to) is the one that decides whether to accept it, not you.

• Why record when we became aware? Isn't it safer not to know?

  No: not recording it doesn't make you safer, it makes you undefended. Whoever told you about the vulnerability or incident almost always has their own timestamped record of when, so your awareness is rarely a secret only you hold, and deniability only works if every single person who saw it stays quiet forever. The penalty for not reporting is far larger than the cost of reporting, and without your own record you can't prove you were on time either, so a regulator investigating later has to assume the worst date against you.