Is the 72-hour notification the final CRA report?

No. Article 14 also provides for a later final report, with timing depending on the event type.

Does the 72-hour stage replace the 24-hour warning?

No. They are staged reporting obligations. The early warning comes first, followed by the fuller notification.

Where is the notification submitted?

Through ENISA's CRA Single Reporting Platform, subject to the official process and applicable guidance.

CRA 72-hour notification: turn the first warning into a fuller case

Understand the CRA 72-hour notification stage for actively exploited vulnerabilities and severe incidents, and what manufacturers should prepare between the 24-hour warning and 72-hour notification.

What changes after the early warning?

The 72-hour stage requires a fuller notification unless the relevant information has already been provided. Depending on the event type, the notification expands on the affected product, nature of the exploit or incident, severity or impact, root cause or threat information where available, and corrective or mitigating measures.

Use the first 48 hours deliberately

After the early warning, teams should maintain a clear log of newly confirmed facts, engineering findings, mitigation decisions and user-facing actions. That prevents the 72-hour notification from becoming a manual reconstruction exercise.

Keep known and unknown information separate

An effective workflow timestamps what changed between stages. That gives the reviewer a clean trail of what was known at 24 hours and what became available later.