Is the CRA final report always due 14 days after the 72-hour report?

No. The 14-day deadline applies to actively exploited vulnerabilities after a corrective or mitigating measure becomes available. Severe incidents use a one-month deadline from the 72-hour notification.

Do the 24-hour and 72-hour stages still apply?

Yes. The final report follows the earlier reporting stages; it does not replace them.

Can CyberAct24 determine which final deadline applies?

CyberAct24 can structure and track the workflow, but event classification and legal reporting decisions remain with the manufacturer's authorised reviewers.

CRA Final Report Deadlines: 14 Days vs 1 Month

Understand the CRA final-report deadlines after the 24-hour and 72-hour stages: 14 days for actively exploited vulnerabilities and one month for severe incidents.

Last reviewed 20 September 2026 against current European Commission and ENISA guidance.

Two different final-report clocks

The CRA does not use one universal final-report deadline. For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure is available. For a severe incident, the final report is due within one month from the 72-hour notification.

Why teams confuse the deadlines

The first two stages are easy to remember—24 hours and 72 hours—but the final stage depends on event type. Your workflow should carry the event classification through the case so the correct final counter is visible to the reviewer.

What the final report should capture

By the final stage, manufacturers should be able to consolidate the confirmed description, severity or impact, corrective or mitigating measures, and other required information applicable to the event. The exact statutory content differs between actively exploited vulnerabilities and severe incidents.

Official guidance: European Commission CRA reporting obligations

CyberAct24 is an independent commercial workflow service, not ENISA, an EU institution, a regulator or a law firm. Regulatory source material should be checked before acting.

CRA final report deadlines: 14 days or one month?