Skip to main content

Automating Early Warnings

The CRA Article 14 early warning is the first notification about an actively exploited vulnerability. It is due 24 hours after you become aware of the vulnerability. CVD Portal helps you prepare it. You file it on the ENISA Single Reporting Platform (SRP).

Prepare the early warning​

  1. Open the report in Submissions.
  2. In the Severity & Art.14 Obligations panel, select Actively exploited in the wild. This starts the Article 14 deadlines.
  3. Open the Art.14 Report drawer. Complete the draft. CVD Portal fills the fields that it already has on the report, for example the product, the description and the severity.
  4. Generate the early warning package. This needs the Reporting plan or higher. CVD Portal saves a fixed copy of what it generated.

File and record​

  1. Submit the package on the ENISA SRP yourself. CVD Portal does not send it to ENISA.
  2. In CVD Portal, mark the stage as filed and enter the SRP reference. Only users with the ADMIN role can do this.

CVD Portal records the time and writes an audit log entry. The 72-hour notification and the final report use the same steps.

Deadline alerts​

On the Reporting plan or higher, a scheduled job checks the Article 14 deadlines every hour. When a deadline is near or has passed, CVD Portal sends an email to your alert recipients and sends the art14.deadline_approaching or art14.deadline_breached event to your webhooks.

Limits​

CVD Portal has no internal approval step for the early warning. An AI agent that uses the API or MCP server cannot file a stage directly. Its request goes into the approval queue, and a person approves or rejects it.

See Article 14 Reporting.