CRA Reporting Kit: templates for Article 14
Everything that needs to be in place before the first notification, as templates to adapt: a playbook with roles and process, an awareness record, notification templates for the ENISA platform, customer information, a CVD policy, classification and standard replies for the security mailbox, a call chain and a deadline calculator.
Free of charge. Six Word templates, two Excel workbooks and a handbook as a PDF, all in English. Based on Regulation (EU) 2024/2847, the Commission guidance C(2026) 5252, ENISA documentation on the reporting platform and BSI TR-03183-3. As of October 2026. Not legal advice.
Final step
Confirm your consent
When you requested the kit, you said you would like to be informed about new versions and changes to the reporting obligation. Please confirm this with one click.
Almost done
Check your inbox
The download link is on its way to . It is valid for 30 days.
In the same e-mail, please also confirm that you would like to receive updates.
Nothing arrived? Please check your spam folder. Use a different address
The link has expired
Download links are valid for 30 days. Simply request the kit again and the new link will arrive straight away.
What is in the kit
Nine files, each with a clear purpose. Placeholders are in square brackets and highlighted in yellow in Word.
- WordReporting playbookThe process from the incoming report to the final report, roles with deputies, decision aids for both triggers, parallel reporting obligations, an emergency route and two exercise scenarios.
- WordInitial assessment and awareness recordThe form that records when the deadlines start. The ENISA platform does not currently ask for this time.
- WordENISA notification templatesAll mandatory fields and the most important optional fields of the single reporting platform for the early warning, the 72-hour notification and the final report, each for vulnerabilities and incidents, with sample wording.
- WordCustomer informationTargeted information for impacted users under Article 14(8) in English, plus an outline for the public security advisory.
- WordCVD policyA coordinated vulnerability disclosure policy with the minimum content set out in BSI TR-03183-3, section 4.4, including a clause on rewards and examples of findings submitted without evidence.
- WordSecurity mailbox and standard repliesFour levels for incoming e-mails, signs of beg bounty and bulk e-mails, an intake log and replies in English, including for demands and threats.
- ExcelReadinessCompany details, call chain, accounts for the reporting platform, product list with Member States, critical systems, external contacts, exercises.
- ExcelDeadlines and case logCalculates every deadline from awareness, depending on the trigger, and shows whether each submission was on time. Plus an event log, a checklist for each stage and a record of how users were informed.
- PDFHandbookAll templates to read and print, with an overview and the five steps to readiness. 32 pages.
Ready in five steps
The reporting obligation has applied since 11 September 2026, including to products that were already on the market before that date.
- Fill in company details and the call chainManufacturer name as in the commercial register, main establishment and the CSIRT designated as coordinator, roles with mobile numbers and deputies.
- Set up two accounts for the reporting platformTwo people with EU Login and multi-factor authentication, one as Primary and one as Secondary Assigned Representative.
- Create the product listProducts, versions and the Member States in which they are made available. The early warning already asks for this information.
- Adapt the playbook and templatesReplace the placeholders, enter your company details in the notification templates, publish the CVD policy and link to it in your security.txt.
- Practise onceWalk through a scenario from the playbook as a tabletop exercise, without real notifications. Whatever was missing is added to the workbook.
Frequently asked questions
What does the kit cost?
Nothing. You receive the download link by e-mail, with no contract and no subscription.
Why only with a business address?
The kit is meant for manufacturers. With a company address, we know who we are dealing with if you have questions. That is why we do not accept addresses from free e-mail services or disposable addresses.
Does the kit replace legal advice?
No. The templates reflect the position as of 8 October 2026 and are based on the text of the Regulation, the Commission guidance and documents from ENISA and the BSI. They have to be adapted to your company; questions of interpretation call for a law firm.
What happens to my address?
We send you the link and receive a copy of your request. You will only receive marketing e-mails if you tick the box and click the confirmation link in the e-mail. For details, see our privacy policy.
Will the kit be updated?
Yes, when the legal position or the reporting platform changes, for example with the German CRA implementation act (CRA-Durchführungsgesetz) or a new release of the ENISA platform. If you tick the box, we will let you know by e-mail.
How does the kit differ from the CRA Response Center service?
The kit describes what you organise yourself. The tool takes over the part that has to run around the clock: monitoring your security mailbox, recognising important reports, alerting your people by SMS and e-mail, and recording awareness, deadlines and history. For the notification itself, you use the templates from the kit. Assessment, decision and submission stay with you.
Templates are a start. Someone has to read the reports at night.
CRA Response Center monitors your security mailbox, recognises important reports and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.