Technical contribution series 2026 · Month 9. Subsequently added on 13 November 2026; legal status: 13 November 2026. The archive date serves the monthly classification.
Manufacturers of digital products need to work together on security incidents in both legal and technical terms. A prepared reporting process combines product knowledge, incident response and clear decisions.
Clear the product reference
First of all, the product concerned and its own role are subject to the relevant rules. Not every cloud service and not every vulnerability triggers the same requirements. Components and required remote processing may be essential for classification.
Documenting knowledge and editing
The manufacturer reporting requirements of Article 14 CRA applicable since 11 September 2026 require a reliable input and rapid assessment. Dates, available information and responsible persons are recorded. Internal response times must leave room for legal review and technical coordination.
Distinguishing reporting channels
Product-related notifications must be distinguished from data breaches and other IT security requirements. A joint incident can trigger several procedures. Remedies, customer information and government communication are therefore coordinated, but not equated at a flat rate.
Four practical examples
Fictitious examples of illustration; the concrete assessment requires examination of the individual case.
Vulnerability exploited actively
A manufacturer learns about attacks on his product. the scope, time of knowledge and reporting obligation shall be examined without delay; Remedy and communication channels continue to run in a coordinated manner.
Software with open source components
A commercial application contains foreign libraries. Roles, component overview and vulnerability process are checked; the open source label does not free the entire product at a flat rate.
Unclear support period
Sales and development call different maintenance periods. Commitments, legal requirements and technical delivery capability will be coordinated before conclusion of the contract.
Product or pure service?
A provider offers an app with the necessary remote processing. The product delimitation is checked using the functions instead of automatically excluding any cloud component.
Deepening and legal basis
Cyber Resilience Act · Official legal basis
Would you like to have a specific process checked? Send request. Scope and remuneration are agreed prior to commissioning.