PROMPX THE ACCESS ISSUE N° 7 THE CRA 24-HOUR CYBER CLOCK The CRA’s 24-Hour Cyber Clock Has Started. Since 11 September 2026, the Cyber Resilience Act has turned vulnerability reporting into an executive operating issue for manufacturers of covered products with digital elements. STATUTORY WINDOW 24:00:00 STATUS / ACTIVE The Cyber Resilience Act is often discussed as a future product-compliance programme. Most of its obligations apply from December 2027. But one of its most operationally demanding requirements is already live. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents having an impact on the security of products with digital elements. A NEW DEADLINE ENTERED THE OPERATING CALENDAR The first deadline is an early warning within 24 hours of becoming aware of the issue. Unless the relevant information has already been provided, a fuller vulnerability or incident notification follows within 72 hours. Final-report deadlines then differ depending on what happened. Reporting now takes place through ENISA’s CRA Single Reporting Platform, which became operational on 11 September. At launch, ENISA confirmed there is no API for automated submission, even though companies can automate their own internal reporting workflows. A 24-hour legal clock is difficult enough. It becomes considerably harder if access, ownership, and submission procedures are established after the clock has started. WHY THIS MATTERS BEYOND SECURITY A 24-hour reporting rule compresses the distance between technical detection and executive judgment. Security, engineering, legal, product, communications, and customer teams cannot assume there will be time to assemble the process after an incident begins. The escalation logic has to exist before the incident. For B2B technology companies, this is commercially relevant as well as regulatory. Enterprise buyers evaluate whether a vendor can respond predictably when something goes wrong. THE HIDDEN PROCUREMENT EFFECT Enterprise customers begin asking vendors for evidence, contract language, incident processes, and product-security responsibilities before every supplier has fully translated the underlying regulation into an operating model. The reporting obligation is not limited to products first placed on the EU market after December 2027. It also applies to in-scope products already made available on the Union market. PRE-INCIDENT CONTROL FRAMEWORK BEFORE THE CRISIS: SIX QUESTIONS TO ANSWER 01 OWNERSHIP Who decides whether an event meets the CRA reporting threshold? 02 FIRST CONTACT Who owns the first 24 hours of the response? 03 FACT VERIFICATION Which facts can be stated with confidence at hour six? 04 PLATFORM ACCESS Who holds verified credentials to ENISA's Single Reporting Platform? 05 DISCLOSURE SCOPE Which users or customer groups need to be informed? 06 ESCALATION SYNC Where do engineering evidence, legal interpretation, and executive sign-off meet? THE PULSE BRIEFING / INCIDENT TELEMETRY STATUTORY DEADLINES / EU CRA ARTICLE 14 11 SEP 2026 Article 14 reporting obligations came into active force. 24 HOURS Early warning after becoming aware of an active exploit or severe incident. 72 HOURS Notification submit deadline unless the required information has already been supplied. 14 DAYS Final report deadline for vulnerabilities, post-mitigation. 01 MONTH Final report deadline for severe incidents, post-72-hour notification. 11 DEC 2027 Full CRA applicability and open-source steward obligations. > INCIDENT_CLOCK: ACTIVE > DETECTION: CONFIRMED > EXECUTIVE_OWNER: REQUIRED > PLATFORM_ACCESS: VERIFY_BEFORE_CRISIS > NEXT_DEADLINE: 24H PROMPX PULSE / LIVE INQUIRY INCIDENT OWNER? Who owns the first 24 hours of a serious product-security incident in your company? [ A ] CISO [ B ] CTO / ENGINEERING [ C ] LEGAL [ D ] CROSS-FUNCTIONAL INCIDENT LEAD QUESTIONS WORTH TAKING TO THE TABLE 01. Can our incident team meet the 24-hour requirement without inventing a new approval chain during a crisis? 02. Have the people who may need to file a CRA notification already been identified and given verified platform access? 03. What evidence will enterprise customers ask for during vendor security reviews? 04. Does our product-security narrative match our actual operating process? 05. Do we know which of our products actually fall within CRA scope today? VISUAL NARRATIVE / THE HOST & THE TABLE THE FINAL WORD A deadline does not create operational capability; it merely tests it. The companies that establish clear threshold logic today will lead when the clock begins ticking. Until next issue, PrompX