Why settle it now
The early warning is due within 24 hours of becoming aware. A team can lose most of that window on questions that have nothing to do with the incident:
- Which legal entity is the manufacturer?
- Where are product cybersecurity decisions mainly taken?
- Do we have an authorised representative in the EU?
- Which importer or distributor places this product on the EU market?
- Where are most of our users?
- Who can submit through ENISA's Single Reporting Platform?
These are company facts, not incident facts. Record them before an incident.
Rule 1: main establishment
Article 14(7) starts with the Member State of your main establishment in the EU, meaning where decisions related to the cybersecurity of your products with digital elements are mainly taken. That is not automatically the country where you are incorporated, where you sell most, or where your incident responders sit.
Rule 2: no main establishment in the EU
Article 14(7) then sets an order:
- the Member State where the authorised representative acting for the highest number of your products is established;
- if you have none, the Member State where the importer placing the highest number of your products on the market is established;
- if there is no importer, the Member State where the distributor making the highest number of your products available is established;
- if none of those applies, the Member State where most of your users are.
For non-EU manufacturers this belongs in launch planning, not in the incident channel.
What to put in your routing record
One note per in-scope product or product family:
- manufacturer legal entity and product;
- where cybersecurity decisions are mainly taken;
- authorised representative, importer and distributor, if any;
- your best current view of where most users are;
- internal owner for Article 14 reporting, and who can submit on ENISA's platform;
- evidence for the route you chose, and the date you last reviewed it.
Where this sits in the deadline chain
The route feeds every step: the 24-hour early warning, the 72-hour notification, and the final report (14 days after a fix is available for an exploited vulnerability, or one month after the 72-hour notification for a severe incident). CRA Article 14 reporting deadlines explained · CRA Article 14 final report: deadlines and contents.
Questions people ask
- Which CSIRT do manufacturers notify under CRA Article 14?
- The CSIRT designated as coordinator in the Member State where the manufacturer has its main establishment in the EU. Reports are submitted through ENISA's Single Reporting Platform.
- What does main establishment mean for CRA Article 14?
- Under Article 14(7), the main establishment is where decisions related to the cybersecurity of the manufacturer's products with digital elements are mainly taken.
- What if the manufacturer has no main establishment in the EU?
- Article 14(7) sets an order: the Member State of the authorised representative acting for the highest number of the manufacturer's products; failing that, of the importer placing the highest number of them on the market; failing that, of the distributor making the highest number of them available; failing all of those, the Member State where the highest number of the manufacturer's users are located.
- Should non-EU manufacturers decide the CSIRT route before an incident?
- Yes. The early warning is due within 24 hours of becoming aware, so the routing facts (main establishment, authorised representative, importer, distributor, user base) are best recorded in advance.
- Does VexRoute file the report for me?
- No. You file through ENISA's Single Reporting Platform. VexRoute's free desk helps you record your route, log cases and track the deadlines.