Cyber Resilience Act Response Center Request a demoDemo

Guide Last updated 13 min read

Outsourcing the CRA reporting obligation: what a service provider can and cannot take on

The reporting obligation under Article 14 rests with the manufacturer, and it cannot be handed over. What can be handed over is the readiness behind it: an address someone reads, an initial check, a call chain, the deadline clocks and the record. This page draws the line and sets out criteria for choosing a provider.

A service provider can take on receiving vulnerability reports, checking them first, alerting the people responsible, tracking the deadlines, drafting the notification and keeping the record. What it cannot take on is the responsibility. The obligation under Article 14 stays with the manufacturer. So do the decision whether a case must be reported, the submission on the ENISA platform by the manufacturer's own designated person, and fixing the vulnerability in the product. For a small or medium-sized manufacturer without its own product security team, this division of work is how to meet the 24-hour deadline at night and at weekends without building a team for it.

Key points

  • Can be outsourced: intake, triage, alerting, deadline clocks, drafting the notification, the evidence record.
  • Cannot be outsourced: the obligation itself, the decision whether to report, the submission by the manufacturer's designated person, the fix.
  • The deadline runs from the moment the manufacturer becomes aware (Article 14(2) and (4)). A provider that checks reports at night makes sure awareness arises early and is documented.
  • Selection criteria: availability, evidence, data protection, cover for absences, test alerts, and nobody who decides in your place.
  • Half of the German industrial companies surveyed by PwC in 2026 have no external channel for receiving reports. A service closes this gap faster than an in-house team.

Why can the obligation not be handed over, when the work can?

Article 14(1) requires the manufacturer to notify an actively exploited vulnerability. Paragraph 2 sets the deadline for the early warning notification: "without undue delay and in any event within 24 hours of the manufacturer becoming aware of it". The obligation is addressed to the manufacturer, not to anyone acting for it. On the ENISA platform, the notification is submitted by an Assigned Representative, a person registered for the manufacturer who signs in with EU Login. The market surveillance authority can later require the manufacturer to show that the deadlines were met. A contract with a service provider does not change any of this.

What the Regulation does not prescribe is who does the work beforehand. Annex I, Part II requires a contact point through which third parties can report vulnerabilities, and a coordinated vulnerability disclosure policy. BSI TR-03183-3, a technical guideline from the German Federal Office for Information Security, describes how such a reporting address is run: security.txt, the roles of PSIRT and CSIRT, a first reply within 5 working days, a detailed response within 10 working days, and a rule that no single analyst may close a report alone. None of this has to happen in-house. The guideline asks for results, not for a particular organisational form.

What can a service provider legally take on?

TaskService providerManufacturerBasis
Run the reporting address (mailbox, security.txt, form)yesremains responsible for publishing itAnnex I, Part II; BSI TR-03183-3
Check and classify every report (triage)yes, as preparationdecides on the classificationArticle 14(1) and (3)
Alert the people responsible until someone takes the case onyesprovides the call list and the peopleno requirement in the Regulation
Track the deadlines: 24 hours, 72 hours, 14 daysyesremains responsible for meeting themArticle 14(2) and (4)
Draft the early warning and the notificationyesreviews and completesArticle 14(2)
Decision: reportable or notnoyesArticle 14(1) and (3)
Submission on the ENISA platformnoyes, by the designated personArticle 16, the platform's role model
Inform userscan draftyesArticle 14(8)
Fix the vulnerability, deliver the updatenoyesArticle 13, Annex I, Part II
Keep the evidence recordyespresents it to the market surveillance authorityinformation rights of the market surveillance authorities

The delicate middle: awareness and triage

The deadline starts with awareness. The Commission guidance of 27 July 2026 ties this to the completion of an initial assessment that gives a reasonable degree of certainty. The manufacturer should record that moment itself, because according to the ENISA FAQ (as of 3 October 2026) the platform does not yet use it to calculate deadlines. This is exactly where a service provider is useful, and also where its role ends. It can look at an incoming report straight away, classify it and wake the person responsible, so that the initial assessment happens quickly and its timing is recorded. But it must not take the place of that assessment. A manufacturer that hands the decision on reportability to a third party loses control over the moment its own deadline starts, and cannot later show who knew what and when. More on when the deadline starts in When does the 24-hour deadline start?.

How do you recognise a service worth using?

  1. Availability, precisely describedWho reads the report at three in the morning: a system that raises the alarm, or a person? Either can be right, but it has to be in the contract. A provider that promises "24/7" without saying what that means is promising nothing.
  2. EvidenceEvery report, every classification, every alert, every hand-over and every submission must be logged with a timestamp, so that the manufacturer can present the record to the market surveillance authority. Without a record, the deadline cannot be proven.
  3. Data protection and confidentialityVulnerability reports contain details attackers could use, and often personal data about the people who report them. Processing in the EU, a data processing agreement under the GDPR, access only for named people.
  4. Cover on both sidesThe manufacturer needs a second designated person for the platform and a call list with deputies. On the provider's side it must be clear what happens if its system fails.
  5. Test alertsA call chain that has never been triggered is an assumption. Regular test alerts with a record show whether the numbers are right and how long it takes to reach senior management.
  6. Nobody who decides for youA service that promises to "take over the reporting obligation completely" crosses the line drawn by Article 14. The decision and the submission must stay with the manufacturer. Anything else is a risk, not a service.
  7. No pretence of official backingNo source shows that ENISA, the BSI or CERT-Bund have commissioned or approved service providers. Treat anyone who presents themselves that way with caution.

What does it cost, and what does it save?

The alternative to a service is an in-house product security team (PSIRT) with on-call cover. That means at least two people who take turns being reachable, a mailbox someone checks every day, platform access that is already set up, with a deputy, and a procedure that still works when one person is on holiday. How small and medium-sized manufacturers can set this up is explained in PSIRT for SMEs.

Two studies from September 2026 show how large the gap is. According to the PwC Product Security Survey 2026 (100 German industrial companies, two thirds of them in mechanical engineering), 50 per cent have no external channel for receiving reports and 27 per cent have no internal process for product security incidents; only 3 per cent consider themselves fully compliant. According to a survey by Bitkom, the German digital industry association, published on 10 September 2026, only 29 per cent of companies know what the CRA means for them; Bitkom sums this up as only 3 in 10 companies being prepared. A service does not replace the process; it puts it in place faster than building your own, and keeps it running. What it costs depends on the provider; CRA Response Center starts at EUR 190 per month, plus set-up at a fixed price.

To put the risk in context: under Article 64(2), infringements of Article 14 can be punished with administrative fines of up to EUR 15 million or 2.5 per cent of total worldwide annual turnover, but only from 11 December 2027 (Article 71(2)). Under Article 64(10), microenterprises and small enterprises are exempt from fines for missing the 24-hour deadline. Regardless of fines, the market surveillance authority can still ask later for evidence that the deadlines were met. Details in Fines and market surveillance.

How CRA Response Center works

CRA Response Center is a private service provider with a tool for part of the outsourceable side of the table above: monitoring, recognising, notifying and recording. It does not draft or submit the notification. The building blocks:

  • Monitoring the mailbox. The tool monitors your security mailbox, either through forwarding to a virtual mailbox or with read-only access (IMAP, Microsoft 365, Google). It never replies, and never moves or deletes anything. Further mailboxes such as psirt@ or csirt@ can be added for an extra charge.
  • Important or Everything else. Fixed rules recognise mail from authorities, claimed exploitation, extortion and unreadable e-mails. An AI running on our hosting provider's servers in Germany also recognises hints of vulnerabilities, even in clumsy English or German or phrased as a polite question. E-mail texts never go to OpenAI, Anthropic, Google or any other AI provider, and are never used to train AI models. The AI may only escalate; only a person can downgrade. What the tool needs to know about your products and components is collected in a questionnaire during set-up.
  • Alerts. For important e-mails, your people receive an SMS or an e-mail, around the clock or only during office hours, depending on your settings. Once per e-mail, with a one-sentence classification instead of the e-mail text. Whoever takes the case on clicks a button, and the others are told. We do not run a staffed control room that decides in your place.
  • Awareness and deadlines. Once active exploitation or a severe incident is sufficiently certain, the person responsible on your side confirms this with one click. From then on, the tool shows the deadlines for the early warning, the notification and the final report. Submission is made by your designated person with their own access, never by us.
  • History as evidence. Receipt, notifications, hand-over, awareness and completion with timestamps, available for export at any time. We store e-mail texts encrypted for 30 days, important ones until 3 months after completion.
  • Set-up. Done yourself in the browser: account, connecting the mailbox, questionnaire, people, test alert. If you wish, we can guide you through set-up at a fixed price.

EUR 190 per month including VAT for one mailbox, EUR 30 for each additional one; the first 30 days are free. What stays with you: deciding whether a case must be reported, drafting and submitting the notification, and the fix. Prices are listed under Pricing, and you can try the service via the request form.

Common mistakes

  • Outsourcing the decision as well. A contract under which the service provider "reports" does not shift any responsibility, but it does take away the manufacturer's control over when its own deadline starts.
  • Only one designated person. Access to the platform then depends on one human being who takes holidays and falls ill. Two designated people are the minimum.
  • Setting up the service and never testing it. Without a test alert, nobody knows whether the call chain reaches senior management at three in the morning.
  • Publishing the address before anyone reads it. A security.txt without a staffed mailbox creates awareness that nobody acts on. For set-up, see security.txt under RFC 9116 and BSI TR-03183-3; the file itself can be created with the security.txt generator.
  • Assuming the NIS2 report covers it. An entity that falls under NIS2 also has to report there. One report does not replace the other.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

Can I outsource CRA reporting to a service provider?

The work beforehand, yes: intake, checking, alerting, deadlines, drafting, record. Of these, CRA Response Center takes on intake, classification, notification, deadlines and the record. The manufacturer submits the notification itself through its designated person on the ENISA platform, and the obligation under Article 14 stays with it.

Can the service provider act as Assigned Representative on the platform?

The platform's role model provides for designated people from the manufacturer. CRA Response Center does not act as Assigned Representative and never submits anything itself. The Regulation does not say explicitly whether a manufacturer may designate an external representative. Nor does it prohibit it: Article 18 allows an authorised representative appointed by written mandate, and Article 18(2) does not exclude the reporting obligation from that mandate. The platform role alone is not a mandate, and the responsibility stays with the manufacturer. Clarify the specific case with legal advice and against the platform's terms.

What happens if the incident becomes known at the weekend?

The deadline runs from awareness, on Saturdays too. That is why the reporting address has to be checked and the call chain triggered at weekends as well. This is exactly the part a service takes on; the person who is woken up makes the decision.

Is it enough for the service provider simply to look at reports and forward them?

No. Forwarding without checking creates noise, and noise gets ignored. What helps is a reasoned classification in which signs of exploitation are never downgraded, plus alerting that only stops once someone takes the case on.

Who is liable if the service provider misses an alert?

Towards the market surveillance authority, the manufacturer is. What the service provider owes the manufacturer is governed by the contract. That is why availability should be described precisely there and the record agreed as evidence.

Do I still need my own PSIRT?

At least one designated person who decides and submits, plus a deputy. A whole team is not needed if intake, checking, alerting and deadlines are outsourced. How much in-house structure makes sense depends on the number of products and the risk.

Does the service replace legal advice?

No. Whether a case must be reported remains the manufacturer's decision, with legal advice if in doubt. The service makes sure that this decision can be taken in time and is documented.

Further reading

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days