CN CRA NotebookCRA 閱讀筆記
Last reviewed 29 Apr 2026最後校閱 2026-04-29 · 11 min read閱讀 11 分鐘 · Mechanism機制 · Standing校正

One door. Two clocks. A cascade that decides where you land. 一道。兩個時鐘。一個 cascade 決定你落到哪。

The Single Reporting Platform is the most concrete piece of CRA infrastructure manufacturers will ever touch. From 11 September 2026 it is the only legitimate way to file an Article 14 notification. The mechanics underneath are not as simple as "submit once" suggests — there are two parallel reporting tracks, three clocks per track that anchor differently, and a CSIRT cascade that quietly decides which Member State you answer to. SRP 是 CRA 基礎設施中,製造商會實際碰到最具體的一塊。2026 年 9 月 11 日起,它是 Article 14 通報的唯一合法途徑。底下的機制沒有「submit once」聽起來那麼簡單——有兩條平行 reporting track、每條 track 有三個起算點不同的時鐘、一個 CSIRT cascade 安靜地決定你向哪個會員國答覆。

An APAC manufacturer hit by an actively exploited vulnerability in 2026 faces a 24-hour reporting deadline. Without a single channel, that manufacturer would also face 27 different national CSIRTs to choose from, each with its own intake form, its own escalation contact, its own clock interpretation. The Single Reporting Platform exists to collapse that fan-out into one door. Article 16 of the CRA is the legal mandate for the platform; ENISA is its operator; and on 11 September 2026 the platform becomes the only legitimate way to file an Article 14 notification.

That date matters more than people realise. Article 14’s reporting obligations enter application fifteen months before the rest of the CRA’s substantive obligations. A manufacturer who only watches the 11 December 2027 full-applicability date will discover, in late 2026, that its first compliance test arrived early.

The infrastructure is one door. The compliance work behind that door is two reporting tracks, three clocks per track, and a Member-State routing decision the manufacturer does not get to make. Anyone who treats the SRP as "just a form" gets the easiest part right and the substantive part wrong.

§ 01What gets reported — mandatory and voluntary

Article 14 carries the mandatory categories. Two of them, distinct by intent and by legal basis:

Article 15 carries the voluntary lane. Any natural or legal person may notify vulnerabilities (not yet exploited), cyber threats, incidents, and near misses. The voluntary lane is interesting for a reason that is not obvious: a manufacturer who reports a vulnerability voluntarily under Art 15 — before it becomes "actively exploited" — does not trigger the Art 14 24-hour clock. For a coordinated vulnerability disclosure (CVD) workflow where the patch is not yet ready but a CSIRT relationship needs to start, this is a usable mechanism rather than a fallback.

§ 02Three clocks per track, anchored differently

The most-quoted summary of Article 14 is "24h / 72h / 14d". That summary is incomplete in a way that matters when a real incident lands.

Track 24 hours 72 hours Final report
Vulnerability — Art 14(2) Early warning, from becoming aware Vulnerability notification 14 days, anchored on corrective measure available
Severe incident — Art 14(4) Early warning, from becoming aware Incident notification 1 month, anchored on 72-hour notification submission

The two final-report clocks anchor to different events. This is easy to miss. Many summaries collapse them into "14 days" as if it were a single deadline. It is not. A severe incident’s final report runs a separate one-month track that starts when the 72-hour notification is submitted, not when corrective measures are available, and not when the issue was first detected. A team that drafts an incident-response runbook against the wrong anchor will be late on the right clock.

§ 03Who receives the report — and where APAC manufacturers actually land

The default routing under Art 14(7) sends the notification to two destinations simultaneously: the CSIRT designated as coordinator in the Member State of the manufacturer’s main establishment, and ENISA. The receiving CSIRT then disseminates onward across the EU CSIRT network — subject to the dissemination-delay grounds covered below.

For a manufacturer with no main establishment in the Union — which is most APAC OEMs — the third subparagraph of Art 14(7) sets a four-step cascade:

Order Member State chosen by Tie-breaker
(a) Where the authorised representative is established Highest number of products
(b) If no AR: where the importer places products on the market Highest number of products
(c) If no importer: where the distributor makes products available Highest number of products
(d) If none of the above: where the most users are located Highest number of users

The order matters in a way Art 18 alone does not surface. Choosing an authorised representative is not just a box-check on the manufacturer obligation list — it is the decision that determines which Member State’s CSIRT receives every Article 14 notification for the lifetime of that product line. Fragmenting AR appointments across multiple Member States to "spread risk" instead spreads obligations and complicates routing. There is one practical exception built into the regulation: under the third subparagraph, point (d), a manufacturer may continue submitting subsequent notifications to the same CSIRT it first reported to, even if the user-base distribution shifts. But the initial designation is the one that does most of the work.

§ 04Two paths to delay — and they are not the same path

"Submit once and the rest happens automatically" describes the default. Two separate mechanisms can introduce delay or restrict access, and they are routinely conflated. Disentangling them is worth doing, because they trigger differently and they sit on different sides of the manufacturer-CSIRT-ENISA triangle.

Path one: receiving CSIRT delays dissemination to other CSIRTs. This is the path the Commission Delegated Regulation adopted on 11 December 2025 codifies. The Delegated Regulation supplements Art 14(9) and identifies three categories of cybersecurity-related grounds under which the CSIRT initially receiving the notification may delay forwarding it onward.

Category Trigger Delegated Reg. article
Nature of the notified information Cybersecurity risk of dissemination outweighs benefits — e.g. a risk-mitigation measure is expected within 72 hours, or the CSIRT is acting as a trusted intermediary in an ongoing CVD process under NIS2 Art 12(1). Art 3
Receiving CSIRT cannot guarantee confidentiality The relevant CSIRT is itself affected by a cybersecurity incident, or there is sufficient reason to believe its capabilities are inadequate to protect the information. Art 4
SRP itself compromised or unavailable ENISA has informed the CSIRTs Network that the platform’s confidentiality cannot be assured. Art 5

The Delegated Regulation also contains a carve-out the explainers of this regime tend to skip: under Recital (7), if the manufacturer indicates that the product is made available only on the market of the Member State of the CSIRT initially receiving the notification, that CSIRT need not disseminate the notification to any other relevant CSIRT at all. For an APAC OEM whose EU subsidiary sells exclusively into one Member State (rare for hardware, more common for niche software products), the dissemination question never arises — not because of delay grounds, but because the geographic scope makes onward dissemination unnecessary by definition.

Path two: manufacturer marks sensitive content; ENISA gets only partial information. This is the Article 16(2) path, which sits inside the CRA itself rather than in the Delegated Regulation. In particularly exceptional circumstances — specifically where the manufacturer actively flags one of the three conditions in Art 16(2)(a) to (c) inside the 72-hour vulnerability notification (Art 14(2)(b)) — ENISA receives only partial information: that a notification was made, general information about the product, the general nature of the exploit, and that security-related grounds were invoked. The full notification is disseminated to the relevant CSIRTs and ENISA only when conditions allow. Note that this manufacturer-marking mechanism is scoped to the vulnerability notification under Art 14(2)(b); it does not extend to the severe-incident 72-hour notification under Art 14(4)(b).

The two paths are independent. Path one is a CSIRT-to-CSIRT decision about onward dissemination, made after the report is received. Path two is a manufacturer-side choice about ENISA’s access to the report content, made at the moment of submission. A real incident may trigger one, both, or neither. Treating them as the same mechanism — or assuming the manufacturer can request the dissemination delay — is a common mistake.

Source note Status of the Delegated Regulation as at April 2026: the act was adopted on 11 December 2025 and published in the Official Journal as Commission Delegated Regulation (EU) 2026/881 on 20 April 2026 (ELI: data.europa.eu/eli/reg_del/2026/881/oj). Per Article 6, it enters into force on the twentieth day following publication — 10 May 2026. The European Commission’s Implementation page may still list the act as “publication pending” due to lag in updates; the OJEU text governs. Verbatim sources cited above: Article 3(a), (b), (c), (d) for the four nature-of-information delay conditions; Article 4(a), (b) for the specific-CSIRT confidentiality grounds; Article 5 for the SRP-platform-compromised ground; Recital (2) for the scope of the manufacturer-side Art 16(2) marking (limited to the 72-hour vulnerability notification under Art 14(2)(b)); Recital (7) for the single-Member-State carve-out.

§ 05What ENISA does beyond running the platform

The platform is the most visible part of ENISA’s role under Article 16. The wider role, articulated in the ENISA SRP FAQ and in Article 17, includes:

The biennial trend report is worth pausing on. Notifications submitted to the SRP feed ENISA’s biennial state-of-cybersecurity report under NIS2 Article 18. What an APAC manufacturer reports in November 2026 becomes part of how the EU describes its own cyber posture in the autumn of 2028. Reporting accuracy, in that sense, has a longer half-life than the immediate incident.

The platform is one door. Behind the door, two clocks anchored differently, two paths to delay that work differently, and a cascade that picks your CSIRT before you do.

§ 06Three things to do before September 2026

The list is shorter than the consultancy decks suggest. Three items, sequenced by what depends on what:

Action Why it has to be first Source
Designate the authorised representative — for non-EU manufacturers — and understand which CSIRT that decision delivers you to. The cascade in Art 14(7) third subparagraph runs on this designation. Every other reporting decision flows from which Member State’s CSIRT receives the notification. Art 14(7), Art 18
Build the internal triage capability. Named owner, escalation path, drafting templates, a tabletop exercise. 24 hours is short; the bottleneck is internal escalation, not technical assessment. The clock starts when a reasonable engineer first thinks "this looks like an actively exploited vulnerability". Designating the owner after the clock has started is how teams miss the 24-hour mark. Art 14(2)(a), Art 14(4)(a)
Decide the CVD posture. Article 15 voluntary reporting is a tool, not just a fallback — the question is whether you want CSIRTs in the loop before a vulnerability becomes "actively exploited". Once a vulnerability is actively exploited, the 24-hour clock runs whether you wanted CSIRT involvement or not. Voluntary disclosure earlier preserves choice and aligns with Delegated Reg. Art 3(d) on CVD-based dissemination delay. Art 15, Delegated Reg. Art 3(d)

Note what is not on this list: a full vulnerability handling programme. That sits in Article 13 and Annex I Part II, and applies from 11 December 2027. The September 2026 deadline only triggers when a manufacturer "becomes aware of" a qualifying event. No event, no Article 14 action. The runway between September 2026 and December 2027 is fifteen months wide, and using it for the construction work that Article 13 mandates — rather than compressing that work into the runway before September 2026 — is what separates a calm 2026 from an expensive one.

The SRP is the door. The cascade decides which Member State opens it. The two clocks decide what happens after. Knowing which is which is the first compliance test of the CRA, and it lands fifteen months before most teams expect.

2026 年某 APAC 製造商收到「actively exploited vulnerability」通報,要在 24 小時內處理。沒有單一管道之前,這家廠商還要從 27 個會員國 CSIRT 中挑一個——每個有自己的表單、自己的升級窗口、自己對時鐘的解釋。SRP 存在的用途,就是把這個放射狀的散點收進一道門。CRA Article 16 是法律授權,ENISA 是運營者,2026 年 9 月 11 日起,SRP 是 Article 14 通報的唯一合法途徑。

這個日期的重要性常被低估。Art 14 通報義務,比 CRA 其他實質義務早十五個月生效。只盯著 2027 年 12 月 11 日 full-applicability 的廠商,會在 2026 年下半年發現第一道合規關卡已經到了。

基礎設施是一道門。門後面的合規工作是兩條平行 reporting track、每條 track 三個時鐘,再加一個由監管側決定(不由製造商挑選)的會員國 routing。把 SRP 當「一個表單」處理的人,把最簡單的部分做對,把實質的部分做錯。

§ 01通報什麼 —— 強制 vs 自願

Article 14 承載強制通報兩類,依立法目的跟法源各自區分:

Article 15 承載自願通報。任何自然人或法人皆可通報弱點(尚未被 exploited)、cyber threat、incident、near miss。自願通報的用途有個不明顯的點:當廠商以 Art 15 自願通報一個尚未變成「actively exploited」的弱點時,不會觸發 Art 14 的 24 小時時鐘。對 patch 還沒備妥但 CSIRT 關係要開始建立的 CVD workflow 來說,這是可用機制,而不只是 fallback。

§ 02每條 track 三個時鐘,起算點不同

關於 Article 14 最常被引用的摘要是「24h / 72h / 14d」。在實際事件落地時,這個摘要是不完整的,而且差別有實質影響。

Track 24 小時 72 小時 Final report
弱點——Art 14(2) Early warning,從知悉起算 Vulnerability notification 14 天,從矯正措施可用起算
嚴重事件——Art 14(4) Early warning,從知悉起算 Incident notification 1 個月,從72 小時通報提交起算

兩個 final report 時鐘起算到不同的事件上。這很容易看漏。很多摘要把它們合成「14 天」當作通用 deadline,但不是。嚴重事件的 final report 跑的是另一條 1 個月的軌道,起點是 72 小時通報提交、不是矯正措施可用、也不是初次發現。incident response runbook 對到錯的 anchor,會在對的時鐘上 late。

§ 03誰收到報告 —— APAC 製造商實際落到哪裡

Art 14(7) 的預設路徑把通報同時送到兩個地方:製造商主要 establishment 所在會員國的 coordinator CSIRT、ENISA。Receiving CSIRT 之後再依 EU CSIRT 網路向其他相關 CSIRT 散播,以下節描述的延遲條件除外。

製造商在歐盟沒有 main establishment 時——也就是大部分 APAC OEM 的情況——Art 14(7) 第三段設一個四步 cascade:

順位 會員國依 同分判準
(a) Authorised representative 所在會員國 產品數最多
(b) 無 AR:importer 投放產品的會員國 產品數最多
(c) 無 importer:distributor 販售產品的會員國 產品數最多
(d) 都沒有:用戶最多的會員國 使用者數最多

這個順序在 Art 18 單獨看時不會浮現的方式上重要。指定 AR 不是製造商義務清單上的一個勾選題,它是決定該產品線整個生命週期內所有 Article 14 通報落到哪個會員國 CSIRT 的決定。把 AR 拆給多個會員國「分散風險」,結果是分散義務、路徑碎片化,而不是減壓。法規裡有一個實務例外:依第三段 (d) 點,廠商首次通報後的後續通報可以繼續送到同一個 CSIRT,即使後來用戶基數分布變了。但首次指定就把後面的工作大致決定了。

§ 04兩條延遲路徑 —— 而且不是同一條

「submit once,剩下自動處理」描述的是預設情況。有兩個獨立機制可以引入延遲,或限制存取,常被混為一談。把它們解開值得做,因為觸發條件不同,它們也站在 manufacturer-CSIRT-ENISA 三角的不同邊。

路徑一:receiving CSIRT 延遲對其他 CSIRT 的散播。這是 2025 年 12 月 11 日採用的 Commission Delegated Regulation 規範的路徑。Delegated Regulation 補強 Art 14(9),列出 CSIRT initially receiving the notification 可以延遲後續散播的三類 cybersecurity-related grounds。

類別 觸發條件 Delegated Reg. 條文
通報內容性質 散播帶來的 cybersecurity 風險高於利益——例如 risk-mitigation measure 預期 72 小時內備妥,或 CSIRT 在 NIS2 Art 12(1) CVD process 中扮演 trusted intermediary。 Art 3
Receiving CSIRT 無法保證機密性 該 CSIRT 自身遭受 cybersecurity incident,或有充分理由相信其能力不足以保護資訊。 Art 4
SRP 自身受攻擊或暫時不可用 ENISA 已通知 CSIRT Network 平台無法保證機密性。 Art 5

Delegated Regulation 還有一個解釋此機制的說明常忽略的 carve-out:依 Recital (7),若製造商標示產品在 receiving CSIRT 所在會員國販售,該 CSIRT 完全不需要對任何其他 CSIRT 散播這份 notification。對 EU 子公司只內銷單一會員國的 APAC OEM 來說(硬體少見、利基軟體較常見),散播議題根本不會出現——不是因為延遲條件,而是因為地理範圍讓「散播」這件事在定義上就沒必要。

路徑二:製造商 mark 敏感內容,ENISA 只收到部分資訊。這是 Article 16(2) 的路徑,這條 sit 在 CRA 本體裡,不在 Delegated Regulation 裡。在 particularly exceptional circumstances 下——具體是製造商在 72 小時弱點通報(Art 14(2)(b))中 actively 標示 Art 16(2)(a) 至 (c) 三個條件之一——ENISA 只收到部分資訊:通報已被提交的事實、產品一般資訊、exploit 一般性質、有 security-related grounds 被引用的事實。完整 notification 在條件允許時才散播給相關 CSIRT 跟 ENISA。注意這個製造商端 marking 機制限定於 Art 14(2)(b) 的弱點通報,不延伸到 Art 14(4)(b) 的嚴重事件 72 小時通報。

兩條路徑是獨立的。路徑一是 CSIRT 之間關於後續散播的決定,由 receiving CSIRT 在收到報告之後做。路徑二是製造商端關於 ENISA 對報告內容存取的選擇,在提交那一刻做。實際事件可能觸發其中一條、兩條都觸發、或都沒觸發。把兩者當作同一機制,或假設製造商可以「要求」散播延遲,都是常見的誤讀。

Source note Delegated Regulation 截至 2026 年 4 月的狀態:該 act 於 2025 年 12 月 11 日採用,並以 Commission Delegated Regulation (EU) 2026/881 編號於 2026 年 4 月 20 日刊登歐盟公報(ELI:data.europa.eu/eli/reg_del/2026/881/oj)。依 Article 6,刊登後第 20 日生效——2026 年 5 月 10 日。歐盟執委會 Implementation 頁面可能因更新時差仍標「publication pending」,但以 OJEU 字面為準。本文 verbatim 引用來源:Article 3(a)、(b)、(c)、(d) 為四類 nature-of-information 延遲條件;Article 4(a)、(b) 為 specific-CSIRT 機密性條件;Article 5 為 SRP 平台受影響條件;Recital (2) 為製造商端 Art 16(2) marking 的範圍(限定於 Art 14(2)(b) 的 72 小時弱點通報);Recital (7) 為單一會員國 carve-out。

§ 05ENISA 除了運營平台還做什麼

平台是 ENISA 在 Article 16 下角色最可見的部分。更廣的角色——在 ENISA SRP FAQ 跟 Article 17 中明確列出——包括:

Biennial trend report 值得多停一下。提交到 SRP 的通報會餵進 ENISA 依 NIS2 Article 18 出版的兩年一份歐盟網路安全現況報告。一家 APAC 製造商 2026 年 11 月通報的內容,會在 2028 年秋天變成歐盟描述自己網路安全姿態的一部分。從這個角度看,通報的精準度有比即時事件更長的 half-life。

平台是一道門。門後是兩個 anchor 不同的時鐘、兩條觸發方式不同的延遲路徑、一個在製造商選之前就把 CSIRT 選好的 cascade。

§ 062026 年 9 月之前要做的三件事

這個清單比顧問簡報短。三件事,依「誰先讓誰可行」排序:

動作 為什麼要先做 Source
指定 authorised representative(非 EU 製造商),清楚這個決定把你導向哪個會員國 CSIRT。 Art 14(7) 第三段 cascade 跑在這個指定上。其他每一個通報決定都從「哪個會員國 CSIRT 收到通報」流出去。 Art 14(7), Art 18
建內部 triage 能力。負責人指定、升級路徑、模板草稿、tabletop 演練。24 小時很短,瓶頸是內部 escalation,不是技術判斷。 時鐘從工程師第一次想到「這像是被積極利用的弱點」開始走。時鐘啟動後才指定負責人,是團隊錯失 24 小時關卡的方式。 Art 14(2)(a), Art 14(4)(a)
決定 CVD posture。Art 15 自願通報是工具,不只 fallback——要不要在弱點變 actively exploited 之前就把 CSIRT 拉進 loop,是策略選擇。 一旦弱點變 actively exploited,24 小時時鐘就跑,不論你想不想要 CSIRT 介入。提早自願揭露保留選擇權,跟 Delegated Reg. Art 3(d) 對 CVD-based 散播延遲對齊。 Art 15, Delegated Reg. Art 3(d)

注意這個清單包括什麼:完整的弱點處理制度。那個放在 Article 13 跟 Annex I Part II,2027 年 12 月 11 日才適用。2026 年 9 月的義務,只在製造商「becomes aware of」符合條件的事件時觸發。沒事件,沒 Article 14 action。2026 年 9 月到 2027 年 12 月之間有十五個月的 runway,把這個 runway 用來做 Article 13 規定的建構工作——而不是把建構工作壓縮進 2026 年 9 月之前——就是「平靜的 2026」跟「昂貴的 2026」的分界。

SRP 是門。Cascade 決定哪個會員國開門。兩個時鐘決定門打開後接下來怎麼走。知道哪個是哪個,是 CRA 的第一道合規測驗——而且它比大多數團隊預期早十五個月降臨。