Cyber Resilience Act reporting sheet: the 24-hour, 72-hour and final-report clocks that apply since 11 September 2026 (Regulation (EU) 2024/2847 Article 14) for accountants and their small software and device clients
What you get: a finished Cyber Resilience Act reporting sheet in three tabs: a product scope tab (one row per product) with a formula that says whether the Article 14 reporting duty applies now; an event clock tab that turns "when did we become aware" into the 24-hour, 72-hour and final-report due dates and flags anything late; and a notification and user-notice template with the fields Article 14 asks for. Four made-up rows show how it fills in.
Short answer: Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), mostly applies from 11 December 2027, but its Article 14 reporting duty has applied since 11 September 2026 (Article 71(2)). It covers every manufacturer of a product with digital elements that is in scope, including products placed on the EU market before 11 December 2027 (Article 69(3)). If such a manufacturer becomes aware of an actively exploited vulnerability or a severe incident affecting the security of its product, it must send an early warning within 24 hours, a notification within 72 hours and a final report later, through ENISA's single reporting point (Article 16) to the CSIRT of its main establishment, and tell affected users (Article 14).
Why accountants and bookkeepers should look at this now
- It is already live. A small client that sells an app, a connected device, firmware or a software component with a network connection may be a "manufacturer" today, even for products sold years ago.
- Many clients will not know. The headline CRA date is December 2027, so most small firms think nothing applies yet. One line in their year-end letter can fix that.
- The clock starts at awareness. The 24 and 72 hours run from when the manufacturer "becomes aware", which is why the sheet records a date and time, not just a date.
- AI features count like any other software. A product with an AI feature is treated like any other product with digital elements for CRA reporting. A business that only uses AI tools bought from others is not a manufacturer of those tools.
Step 1: tab 1, product scope (one row per product)
| Column | What to write | Source |
|---|---|---|
| A. Product | Name and version line | |
| B. Kind | Hardware, installed software, mobile app, firmware, component, online service | Art. 3(1) |
| C. Data connection | Yes/No: intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network | Art. 2(1) |
| D. Made available in the EU commercially | Yes/No: supplied for distribution or use on the EU market in the course of a commercial activity, paid or free of charge | Art. 3(22) and 3(21) |
| E. Under the client's name or trademark | Yes/No: the client develops or has it developed and markets it under its own name or trademark (that makes it the manufacturer) | Art. 3(13) |
| F. Covered by excluded EU law | Yes/No: medical devices (Reg. 2017/745), in vitro diagnostics (2017/746), vehicle type-approval (2019/2144), aviation products under Reg. 2018/1139, marine equipment (Dir. 2014/90/EU) | Art. 2(2) to (4) |
| G. Pure online service | Yes/No: a SaaS or website that does not support the function of a product the client makes. Remote processing the client built and without which its own app or device cannot perform a function counts as part of the product, so answer No for that. | Art. 3(2), Recitals 11 and 12 |
| H. Free open source, not monetised | Yes/No: free and open-source software that the client does not monetise | Art. 3(48), Recital 18 |
| I. Size | Micro (fewer than 10 staff and turnover or balance sheet up to EUR 2 million), Small (fewer than 50 and up to EUR 10 million), Other. Count linked and partner enterprises as the Recommendation says. | Rec. 2003/361/EC Annex Art. 2 |
| J. Main establishment | Member State where cybersecurity decisions on its products are mainly taken; if unclear, where it has most EU employees. Non-EU makers: see Step 4. | Art. 14(7) |
| K. Reporting owner | Who files the notice, with a deputy for weekends | Our working rule |
| L. Result | Formula below |
Result formula for row 2 (Google Sheets or Excel). The order of the tests is our working rule, not wording from the Regulation:
=IF(F2="Yes","OUT: OTHER EU LAW (Art 2)",IF(C2="No","OUT: NO DATA CONNECTION (Art 2(1))",IF(G2="Yes","CHECK: SERVICE, NOT A PRODUCT? (Recital 12)",IF(H2="Yes","CHECK: NOT COMMERCIAL? (Recital 18)",IF(AND(D2="Yes",E2="Yes"),"IN: ARTICLE 14 REPORTING NOW","CHECK: NOT MANUFACTURER, OTHER DUTIES FROM 11 DEC 2027")))))
Made-up example rows (not real companies)
| A | C | D | E | F | G | H | I | L. Result |
|---|---|---|---|---|---|---|---|---|
| Made-up: smart thermostat with phone app, own brand | Yes | Yes | Yes | No | No | No | Small | IN: ARTICLE 14 REPORTING NOW |
| Made-up: booking app that needs the maker's own API | Yes | Yes | Yes | No | No | No | Micro | IN: ARTICLE 14 REPORTING NOW |
| Made-up: browser-only bookkeeping SaaS, no app | Yes | Yes | Yes | No | Yes | No | Small | CHECK: SERVICE, NOT A PRODUCT? (Recital 12) |
| Made-up: web shop reselling imported cameras | Yes | Yes | No | No | No | No | Micro | CHECK: NOT MANUFACTURER, OTHER DUTIES FROM 11 DEC 2027 |
Recital 12 says SaaS and other cloud computing services fall under the NIS2 Directive (EU) 2022/2555 instead, for entities of medium size or larger. A "CHECK" result means read the cited text with the client; it is not an answer.
Step 2: tab 2, event clock (one row per event)
| Column | What to write or the formula | Source |
|---|---|---|
| A. Event ID / B. Product | Free text | |
| C. Type | VULN = actively exploited vulnerability (reliable evidence a malicious actor exploited it in a system without the owner's permission). INCIDENT = severe incident: it affects or can affect the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or it led or can lead to malicious code in the product or in a user's systems. | Art. 3(42), 14(5) |
| D. Aware at | Date and time the client became aware | Art. 14(2), (4) |
| E. Early warning due | =D2+1 (24 hours) | Art. 14(2)(a), 14(4)(a) |
| F. Notification due | =D2+3 (72 hours) | Art. 14(2)(b), 14(4)(b) |
| G. Fix available at | VULN only: when a corrective or mitigating measure became available | Art. 14(2)(c) |
| H. Notification sent at | When the 72-hour notification was actually filed | |
| I. Final report due | =IF(C2="VULN",IF(G2="","14 DAYS AFTER FIX",G2+14),IF(H2="","1 MONTH AFTER NOTIFICATION",EDATE(H2,1))) | Art. 14(2)(c), 14(4)(c) |
| J. Early warning sent at / K. Final report sent at / L. Users told at | Times actually done | Art. 14(8) |
| M. Status | =IF(AND(J2="",NOW()>E2),"EARLY WARNING LATE",IF(AND(H2="",NOW()>F2),"NOTIFICATION LATE",IF(L2="","TELL USERS",IF(K2="","FINAL REPORT OPEN","CLOSED")))) | Our working rule |
Made-up example (not a real event): a VULN on the made-up thermostat, aware 3 Nov 2026 09:40. Early warning due 4 Nov 09:40, notification due 6 Nov 09:40; fix released 12 Nov, so the final report is due by 26 Nov. If it were an INCIDENT notified on 5 Nov, the final report would be due by 5 Dec.
The CSIRT that receives the notice may ask for an intermediate status report (Art. 14(6)). Vulnerabilities that are not actively exploited, near misses and threats can be reported voluntarily (Art. 15).
Step 3: tab 3, what each notice must contain
| Stage | VULN must include | INCIDENT must include |
|---|---|---|
| Early warning (24 h) | Where applicable, the Member States where the client knows the product has been made available | At least whether it is suspected to be caused by unlawful or malicious acts; where applicable, the Member States where the product has been made available |
| Notification (72 h) | General information on the product, the general nature of the exploit and of the vulnerability, corrective or mitigating measures taken and those users can take, and how sensitive the client considers the information | General information on the nature of the incident, an initial assessment, measures taken and those users can take, and how sensitive the client considers the information |
| Final report | Description including severity and impact; where available, information on any malicious actor; details of the security update or other corrective measures | Detailed description including severity and impact; type of threat or likely root cause; applied and ongoing mitigation measures |
User notice template (Art. 14(8) requires telling impacted users, and where appropriate all users, where appropriate in a structured, machine-readable format). Wording is ours:
Subject: Security notice for [product, versions] We found [an actively exploited vulnerability / a security incident] affecting [product, versions] on [date]. What it can do: [one plain sentence]. What we have done: [update or mitigation, with date]. What you should do now: [install version X / change setting Y / contact us]. Questions: [security contact address]. We will update this notice when [the fix is out / the investigation closes].
Step 4: where the notice goes
- Through the single reporting point run by ENISA under Article 16, using the electronic end-point of the CSIRT designated as coordinator in the Member State of the main establishment (column J). It is shared with ENISA at the same time (Art. 14(1), (7) and Art. 16).
- A manufacturer with no EU main establishment uses, in order: the Member State of its authorised representative for most of its products, then of the importer placing most of its products on the market, then of the distributor making most of them available, then where most of its users are (Art. 14(7)).
Fines and the small-firm exception
Breaching Article 14 can lead to fines of up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher (Art. 64(2)), and authorities must take account of the size of micro, small and medium enterprises (Art. 64(5)(c)). Article 64(10)(a) says fines do not apply to microenterprises or small enterprises for failing to meet the 24-hour early-warning deadline. That exception does not cover the 72-hour notification, the final report or telling users. Member States set the penalty rules (Art. 64(1)), so check national law before advising.
Paragraph for the client letter
"You sell [product], which connects to a network and carries your name. Since 11 September 2026 the EU Cyber Resilience Act requires you to report any actively exploited vulnerability or severe security incident affecting it: early warning within 24 hours, notification within 72 hours, then a final report, and to tell your users. This applies to products you sold before that date too. Please name one person and a deputy who will file reports, and keep the attached event sheet. The wider CRA product requirements apply from 11 December 2027; we will review those with you next year."
Keep the AI tool list in one place
If the product has AI features, or the client uses AI tools to write code or answer customers, list them in the EURO AI Register free edition. It runs in your browser with no account and no upload, covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. Attach this reporting sheet as the evidence record for the product.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list the client's AI tools in the EURO AI Register free edition, then add this sheet. Related: NIS2 supplier security questionnaire answer sheet · Product Liability Directive software sheet (9 December 2026) · GDPR personal data breach 72-hour sheet · AI Act Article 73 serious incident reporting
Sources
- Regulation (EU) 2024/2847 of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Recitals 11, 12 and 18, Articles 2, 3(1), (2), (13), (21), (22), (42), (48), 14, 15, 16, 64, 69 and 71, read on EUR-Lex on 28 October 2026: EUR-Lex
- Commission Recommendation 2003/361/EC concerning the definition of micro, small and medium-sized enterprises, Annex Article 2, read on EUR-Lex on 28 October 2026: EUR-Lex
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.