Severe incident
The second trigger for the reporting obligation usually concerns the manufacturer itself: its build pipeline, its update servers, its signing keys. Article 14(5) defines when an incident is severe; not every IT disruption qualifies.
A severe incident (in full: severe incident having an impact on the security of the product with digital elements) is an incident that affects the ability of a product to protect sensitive or important data or functions, or that leads to the introduction or execution of malicious code. It must be reported under Article 14(3).
Definition in the Regulation
Article 3, point (44), of Regulation (EU) 2024/2847 defines an "incident having an impact on the security of the product with digital elements". This is an incident that "negatively affects or is capable of negatively affecting the ability of a product with digital elements to protect the availability, authenticity, integrity or confidentiality of data or functions". When such an incident is severe is not set out in Article 3 but in Article 14(5). It is severe if (a) it negatively affects or is capable of negatively affecting the ability to protect sensitive or important data or functions. Or if (b) it has led or is capable of leading to the introduction or execution of malicious code in the product or in the user's network and information systems. Recital 68 gives the example of an attacker introducing malicious code into the release channel for security updates.
What it means for manufacturers
The deadlines under Article 14(4) are 24 hours for the early warning and 72 hours for the notification, each from awareness, and one month after the 72-hour notification has been submitted for the final report. The early warning must state whether the incident is suspected of being caused by unlawful or malicious acts. A manufacturer that is also an entity under NIS2 additionally reports the same incident under section 32 of the German BSI Act (BSIG); if personal data are affected, a notification under Article 33 GDPR is added. None of these reports replaces another.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Actively exploited vulnerability
- Early warning notification
- Final report
- NIS2 (Directive (EU) 2022/2555)