Article 14 · operational practice
Make awareness time explicit, reviewable and evidenced.
The Article 14 reporting periods run from when the manufacturer becomes aware of the relevant event. Teams need a controlled way to establish and preserve that timestamp while the technical investigation continues.
Direct answer · operational interpretation
What starts the CRA Article 14 reporting clock?
For the applicable actively exploited vulnerability or severe incident, Article 14 measures the early-warning and notification periods from when the manufacturer becomes aware. A ticket timestamp alone does not establish that fact; the organisation should record how awareness was confirmed.
- Applicability
- This describes the timing trigger. It does not decide whether a particular vulnerability, incident, product, or manufacturer falls within Article 14.
- Operational workflow
- Capture the event time, timezone, confirming person, reason and evidence. If the organisation later corrects the awareness time, append the correction and reason, preserve the prior record, and recompute dependent deadlines.
A useful awareness record
- Time and timezone
- Store a precise instant and the timezone used to communicate it.
- Confirming person
- Name the reviewer who confirmed the organisation’s awareness.
- Basis and evidence
- Link the advisory, exploitation evidence, incident record, affected product versions and review rationale.
- Corrections
- Keep the earlier value, changed value, actor, reason and resulting deadline changes in the audit history.
Keep uncertainty visible
An operational process helps a team act consistently; it does not settle the legal meaning of awareness in every factual situation. Escalate uncertain cases to the organisation’s responsible reviewer or adviser. Vellaci records the customer’s decision and its evidence; it does not make the legal determination.
In Vellaci, awareness is explicitly confirmed when a reporting case is opened. Later corrections are appended to awareness history with actor, reason and timezone, and dependent deadlines are recalculated from the updated value.
Practice the hand-off before a real event.
Use illustrative product and vulnerability data to rehearse identification, awareness confirmation, ownership and evidence capture.