{"id":70422,"date":"2026-09-01T13:13:06","date_gmt":"2026-09-01T11:13:06","guid":{"rendered":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/"},"modified":"2026-09-17T14:49:14","modified_gmt":"2026-09-17T12:49:14","slug":"24-hours-to-report-internal-decision-makers","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/","title":{"rendered":"24 Hours to Report: Who Needs to Be Part of the Internal Decision"},"content":{"rendered":"<div id=\"sgce-a\" class=\"sgce-article\">\n<p class=\"rc-lede\">From 11 September 2026, manufacturers must report actively exploited vulnerabilities to a competent CSIRT and simultaneously to ENISA within 24 hours of becoming aware of them. This deadline starts when awareness is gained, not when an internal decision is made about whether to report. Organisations that only clarify responsibility, contacts and triage criteria once an incident occurs lose valuable hours. The reporting obligation under Article 14 of the Cyber Resilience Act only works if the decision chain is already in place beforehand.<\/p>\n<div class=\"rc-tldr\">\n<div class=\"rc-tldr-label\">In short<\/div>\n<p>From 11 September 2026, Article 14 of the Cyber Resilience Act requires an early warning within 24 hours of becoming aware of an actively exploited vulnerability, submitted simultaneously to the competent CSIRT and to ENISA. To meet this deadline, CSIRT assignment, named primary and secondary contacts with a backup rule, and internal triage must already be established before an incident occurs.<\/p>\n<\/div>\n<nav class=\"rc-toc\" aria-label=\"Contents\">\n<div class=\"rc-toc-label\">Contents<\/div>\n<ol>\n<li><a href=\"#a1-what-exactly-must-be-reported-within-24-\">What exactly must be reported within 24 hours?<\/a><\/li>\n<li><a href=\"#a2-which-csirt-is-responsible-and-how-does-\">Which CSIRT is responsible, and how does ENISA come into play?<\/a><\/li>\n<li><a href=\"#a3-why-must-the-decision-chain-be-establish\">Why must the decision chain be established before an incident occurs?<\/a><\/li>\n<li><a href=\"#a4-what-follows-the-early-warning\">What follows the early warning?<\/a><\/li>\n<li><a href=\"#a5-who-is-exempt-from-the-reporting-obligat\">Who is exempt from the reporting obligation?<\/a><\/li>\n<li><a href=\"#a6-what-specifically-needs-to-be-clarified-\">What specifically needs to be clarified by 11 September 2026?<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"rc-figures\">\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"24\">24<span class=\"unit\">hrs<\/span><\/div>\n<div class=\"rc-figure-label\">Deadline for the early warning after becoming aware<\/div>\n<div class=\"rc-figure-src\">cyber-resilience-act.de, Article 14 Reporting Obligations of Manufacturers<\/div>\n<\/div>\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"72\">72<span class=\"unit\">hrs<\/span><\/div>\n<div class=\"rc-figure-label\">Deadline for the follow-up report with detailed information<\/div>\n<div class=\"rc-figure-src\">mogwailabs, Reporting and Disclosure Obligations under the Cyber Resilience Act<\/div>\n<\/div>\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"14\">14<span class=\"unit\">days<\/span><\/div>\n<div class=\"rc-figure-label\">Deadline for the final report after a corrective measure becomes available<\/div>\n<div class=\"rc-figure-src\">itmr-legal, Cyber Resilience Act: Reporting Obligations under the CRA from 11 September 2026<\/div>\n<\/div>\n<\/div>\n<h2 id=\"a1-what-exactly-must-be-reported-within-24-\">What exactly must be reported within 24 hours?<\/h2>\n<p>The manufacturer submits an early warning about the actively exploited vulnerability, naming at least the affected member states, simultaneously to the competent CSIRT and to ENISA.<\/p>\n<p>The deadline starts when awareness is gained and requires action without undue delay, but in any case within 24 hours at the latest. The relevant provision is <a href=\"https:\/\/cyber-resilience-act.de\/cra\/kapitel-2\/artikel-14\/\" target=\"_blank\" rel=\"noopener nofollow\">Article 14 of the Cyber Resilience Act<\/a>, which provides for reporting via the single reporting platform, so that the CSIRT and ENISA receive access at the same time.<\/p>\n<p>This first report deliberately stays brief: it identifies the vulnerability and the affected states, nothing more. Organisations that only clarify who is authorised to report and what information is permissible at this stage have already missed the deadline.<\/p>\n<h2 id=\"a2-which-csirt-is-responsible-and-how-does-\">Which CSIRT is responsible, and how does ENISA come into play?<\/h2>\n<p>The competent CSIRT is the one in the member state of the manufacturer&#8217;s main establishment, in Germany for example the BSI; ENISA receives the same report in parallel via the shared platform.<\/p>\n<p>If a manufacturer has no main establishment in the EU, a statutory order of precedence applies: first the member state of the authorised representative, then of the importer, then of the distributor, and finally the state with the most users. This cascade from Article 14(7) cannot be improvised once an incident occurs; it must be worked through and documented in advance.<\/p>\n<p>Similar uncertainty about one&#8217;s own classification is already visible in the NIS2 registration gap, where companies only clarify their own scope of application at a late stage. Under the Cyber Resilience Act, the short deadline makes this problem even more pressing.<\/p>\n<h2 id=\"a3-why-must-the-decision-chain-be-establish\">Why must the decision chain be established before an incident occurs?<\/h2>\n<p>Because the 24-hour deadline runs from the moment awareness is gained and leaves no time for subsequent organisational clarification, CSIRT assignment, contacts and the approval process must be established in advance.<\/p>\n<p>Before 11 September 2026, a competent CSIRT must be determined based on the location of the main establishment, and a <a href=\"https:\/\/www.advisori.de\/blog\/cra-meldeplattform-enisa-srp-registrierung\" target=\"_blank\" rel=\"noopener nofollow\">primary and secondary contact<\/a> must be named, including a backup rule for holidays and weekends. This preparatory work concerns not only the legal department but also the unit that first detects an actively exploited vulnerability, such as a security operations center.<\/p>\n<p>The backlog visible in other CRA obligations, for instance around the software bill of materials, shows that this kind of preparatory work often only begins late across the industry. Organisations that only clarify approval for a report once an incident occurs lose time that the deadline does not allow for.<\/p>\n<div class=\"rc-callout\">\n<p>CSIRT assignment and named contacts should not be tested for the first time when an incident occurs.<\/p>\n<\/div>\n<h2 id=\"a4-what-follows-the-early-warning\">What follows the early warning?<\/h2>\n<p>Within 72 hours, the manufacturer provides a follow-up report with affected product versions, the type of vulnerability and available measures; a final report follows later.<\/p>\n<p>The final report is due within 14 days of a corrective measure becoming available for an actively exploited vulnerability, or within one month for a severe security incident. The coordinating CSIRT only requests an intermediate report on demand; it is not a standard obligation.<\/p>\n<p>Article 14(8) additionally obliges the manufacturer to inform affected users about the vulnerability; if the manufacturer fails to do so, the CSIRTs may carry out this notification themselves instead. This user notification also requires its own approval, which must be planned into the decision chain.<\/p>\n<h2 id=\"a5-who-is-exempt-from-the-reporting-obligat\">Who is exempt from the reporting obligation?<\/h2>\n<p>Micro and small enterprises remain subject to the reporting obligation but face no fine if they miss the 24-hour deadline; good-faith security research without malicious intent does not fall under the reporting obligation at all.<\/p>\n<p>These exemptions do not change the organisational task: even a small enterprise must know which CSIRT to contact and who approves the report internally. The fine is waived, the deadline is not.<\/p>\n<p>An academic paper describes vulnerability governance as the central lever of this hybrid regulation, in which legally binding requirements are implemented through co-regulation and internal corporate self-regulation, coordinated at EU level by ENISA and the CSIRTs.<\/p>\n<h2 id=\"a6-what-specifically-needs-to-be-clarified-\">What specifically needs to be clarified by 11 September 2026?<\/h2>\n<p>Companies falling under the Cyber Resilience Act should establish the CSIRT assignment, the contacts and the internal approval for the 24-hour report in writing before this date.<\/p>\n<p>A first verifiable step: the unit responsible for product security determines the competent CSIRT by 11 September 2026, based on the main establishment or, in the absence of an EU establishment, on the cascade of authorised representative, importer, distributor and user numbers, and records this in writing. In parallel, primary and secondary contacts with a backup rule are named and integrated into the existing reporting organisation for security incidents.<\/p>\n<p>That short reporting deadlines are not an isolated case is also shown by the BACS reporting deadlines in Switzerland. Organisations that document their own decision chain cleanly once are prepared for both regimes.<\/p>\n<div class=\"rc-bridge\">\n<div class=\"rc-bridge-mark\"><\/div>\n<div>\n<div class=\"rc-bridge-label\">Related<\/div>\n<h3>Mapping vulnerability reporting workflows<\/h3>\n<p>Information Security maps reporting channels and deadlines for vulnerabilities and documents responsibilities and approvals in a traceable way.<\/p>\n<p><a href=\"https:\/\/swissgrc.com\/ar\/information-security-management-isms-software\/\">Information Security <span class=\"rc-pfeil\" aria-hidden=\"true\"><\/span><\/a><\/div>\n<\/div>\n<aside class=\"rc-takeaways\">\n<div class=\"rc-takeaways-label\">For practice<\/div>\n<h2>Key points<\/h2>\n<ul>\n<li>Determine the competent CSIRT based on the main establishment or the statutory cascade before an incident occurs.<\/li>\n<li>Name primary and secondary contacts with a backup rule for holidays and weekends.<\/li>\n<li>Establish in writing who may approve an early warning without a prior case-by-case legal review.<\/li>\n<li>Plan the follow-up report, the final report and the user notification under Article 14(8) into the same process.<\/li>\n<li>Micro enterprises remain subject to the reporting obligation; the same preparation pays off even without the risk of a fine.<\/li>\n<\/ul>\n<\/aside>\n<section class=\"rc-faq\">\n<div class=\"rc-faq-head\">\n<div class=\"rc-faq-label\">FAQ<\/div>\n<h2>Frequently asked questions<\/h2>\n<\/div>\n<div class=\"rc-faq-list\">\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">From when does the 24-hour reporting obligation of the Cyber Resilience Act apply?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>From 11 September 2026, Article 14 of the Cyber Resilience Act requires an early warning within 24 hours of becoming aware of an actively exploited vulnerability. The report goes simultaneously to the competent CSIRT and to ENISA via the single reporting platform.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Which CSIRT is responsible if a manufacturer has no establishment in the EU?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Without an EU main establishment, a statutory cascade applies: first the member state of the authorised representative, then of the importer, then of the distributor, and finally the state with the most users. This order under Article 14(7) must be clarified and documented in advance.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What happens if a micro enterprise misses the reporting deadline?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Micro and small enterprises remain subject to the reporting obligation, but face no fine if they miss the 24-hour deadline. This does not remove the organisational task: they too must know which CSIRT to contact and who approves the report internally.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What information must the first report under Article 14 contain?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The early warning deliberately stays brief and names the actively exploited vulnerability along with at least the affected member states. Further details, such as affected product versions, only follow in the follow-up report within 72 hours.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What follows the early warning under the Cyber Resilience Act?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Within 72 hours, the manufacturer provides a follow-up report with product versions, the type of vulnerability and measures taken. The final report follows within 14 days or one month depending on the case, and Article 14(8) additionally requires informing affected users.<\/p>\n<\/div>\n<\/details>\n<\/div>\n<\/section>\n<section class=\"rc-sources\">\n<div class=\"rc-sources-label\">Sources<\/div>\n<ol>\n<li><a href=\"https:\/\/cyber-resilience-act.de\/cra\/kapitel-2\/artikel-14\/\" target=\"_blank\" rel=\"noopener nofollow\">Article 14 Reporting Obligations of Manufacturers<\/a><span class=\"rc-source-pub\">cyber-resilience-act.de<\/span><\/li>\n<li><a href=\"https:\/\/www.advisori.de\/blog\/cra-meldeplattform-enisa-srp-registrierung\" target=\"_blank\" rel=\"noopener nofollow\">CRA Reporting Platform: What Must Be in Place by 11 September 2026<\/a><span class=\"rc-source-pub\">advisori<\/span><\/li>\n<\/ol>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>From 11 September 2026, Article 14 of the Cyber Resilience Act requires an early warning within 24 hours of becoming aware of an actively exploited vulnerability, submitted simultaneously to the competent CSIRT and to ENISA. To meet this deadline, CSIRT assignment, named primary and secondary contacts with a backup rule, and internal triage must already be established before an incident occurs.<\/p>\n","protected":false},"author":5,"featured_media":70424,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Shayeste Afzaly","real_author_title":"Marketing Manager","real_author_bio":"Focuses on the operational implementation of marketing initiatives and brand activities. Supports campaigns across digital and offline channels and contributes to a target group-oriented, data-driven execution.","real_author_photo":70096,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[105],"tags":[172,173,174,175,176],"class_list":["post-70422","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulation-supervision","tag-csirt-responsibility","tag-24-hour-deadline-vulnerability","tag-enisa-reporting-platform","tag-early-warning-actively-exploited-vulnerability","tag-article-14-cyber-resilience-act"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"Article 14 of the Cyber Resilience Act requires a 24-hour report to CSIRT and ENISA from 2026. Which internal responsibilities must be established beforehand.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"superadmin\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"ar_AR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Cyber Resilience Act: 24-Hour Reporting Obligation Art. 14\" \/>\n\t\t<meta property=\"og:description\" content=\"Article 14 of the Cyber Resilience Act requires a 24-hour report to CSIRT and ENISA from 2026. Which internal responsibilities must be established beforehand.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Beitragsbild-CRA-Meldefrist-v4-Hell-selection-1-scaled.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Beitragsbild-CRA-Meldefrist-v4-Hell-selection-1-scaled.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t\t<meta property=\"og:image:height\" content=\"1440\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-01T11:13:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-17T12:49:14+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Cyber Resilience Act: 24-Hour Reporting Obligation Art. 14\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Article 14 of the Cyber Resilience Act requires a 24-hour report to CSIRT and ENISA from 2026. Which internal responsibilities must be established beforehand.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Beitragsbild-CRA-Meldefrist-v4-Hell-selection-1-scaled.png\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"superadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/#blogposting\",\"name\":\"Cyber Resilience Act: 24-Hour Reporting Obligation Art. 14\",\"headline\":\"24 Hours to Report: Who Needs to Be Part of the Internal Decision\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2026\\\/09\\\/Beitragsbild-CRA-Meldefrist-v4-Hell-selection-1-scaled.png\",\"width\":2560,\"height\":1440,\"caption\":\"Cyber Resilience Act: 24 hours to report\"},\"datePublished\":\"2026-09-01T13:13:06+02:00\",\"dateModified\":\"2026-09-17T14:49:14+02:00\",\"inLanguage\":\"ar\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/#webpage\"},\"articleSection\":\"Regulation &amp; Supervision, CSIRT responsibility, 24-hour deadline vulnerability, ENISA reporting platform, early warning actively exploited vulnerability, Article 14 Cyber Resilience Act\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"position\":2,\"name\":\"Regulation &amp; Supervision\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/#listItem\",\"name\":\"24 Hours to Report: Who Needs to Be Part of the Internal Decision\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/#listItem\",\"position\":3,\"name\":\"24 Hours to Report: Who Needs to Be Part of the Internal Decision\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/\",\"name\":\"superadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/75672523c5e2db95feb2c8c3d6cf134b011e26e6f14621731855ff4a8c3327d7?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"superadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/\",\"name\":\"Cyber Resilience Act: 24-Hour Reporting Obligation Art. 14\",\"description\":\"Article 14 of the Cyber Resilience Act requires a 24-hour report to CSIRT and ENISA from 2026. Which internal responsibilities must be established beforehand.\",\"inLanguage\":\"ar\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2026\\\/09\\\/Beitragsbild-CRA-Meldefrist-v4-Hell-selection-1-scaled.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/#mainImage\",\"width\":2560,\"height\":1440,\"caption\":\"Cyber Resilience Act: 24 hours to report\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/24-hours-to-report-internal-decision-makers\\\/#mainImage\"},\"datePublished\":\"2026-09-01T13:13:06+02:00\",\"dateModified\":\"2026-09-17T14:49:14+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"ar\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Cyber Resilience Act: 24-Hour Reporting Obligation Art. 14<\/title>\n\n","aioseo_head_json":{"title":"Cyber Resilience Act: 24-Hour Reporting Obligation Art. 14","description":"Article 14 of the Cyber Resilience Act requires a 24-hour report to CSIRT and ENISA from 2026. Which internal responsibilities must be established beforehand.","canonical_url":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/#blogposting","name":"Cyber Resilience Act: 24-Hour Reporting Obligation Art. 14","headline":"24 Hours to Report: Who Needs to Be Part of the Internal Decision","author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Beitragsbild-CRA-Meldefrist-v4-Hell-selection-1-scaled.png","width":2560,"height":1440,"caption":"Cyber Resilience Act: 24 hours to report"},"datePublished":"2026-09-01T13:13:06+02:00","dateModified":"2026-09-17T14:49:14+02:00","inLanguage":"ar","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/#webpage"},"articleSection":"Regulation &amp; Supervision, CSIRT responsibility, 24-hour deadline vulnerability, ENISA reporting platform, early warning actively exploited vulnerability, Article 14 Cyber Resilience Act"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/ar\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","position":2,"name":"Regulation &amp; Supervision","item":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/#listItem","name":"24 Hours to Report: Who Needs to Be Part of the Internal Decision"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/#listItem","position":3,"name":"24 Hours to Report: Who Needs to Be Part of the Internal Decision","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/ar\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/ar\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author","url":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/","name":"superadmin","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/75672523c5e2db95feb2c8c3d6cf134b011e26e6f14621731855ff4a8c3327d7?s=96&d=mm&r=g","width":96,"height":96,"caption":"superadmin"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/#webpage","url":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/","name":"Cyber Resilience Act: 24-Hour Reporting Obligation Art. 14","description":"Article 14 of the Cyber Resilience Act requires a 24-hour report to CSIRT and ENISA from 2026. Which internal responsibilities must be established beforehand.","inLanguage":"ar","isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Beitragsbild-CRA-Meldefrist-v4-Hell-selection-1-scaled.png","@id":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/#mainImage","width":2560,"height":1440,"caption":"Cyber Resilience Act: 24 hours to report"},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/#mainImage"},"datePublished":"2026-09-01T13:13:06+02:00","dateModified":"2026-09-17T14:49:14+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/ar\/#website","url":"https:\/\/swissgrc.com\/ar\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"ar","publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"}}]},"og:locale":"ar_AR","og:site_name":"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"Cyber Resilience Act: 24-Hour Reporting Obligation Art. 14","og:description":"Article 14 of the Cyber Resilience Act requires a 24-hour report to CSIRT and ENISA from 2026. Which internal responsibilities must be established beforehand.","og:url":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/","og:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Beitragsbild-CRA-Meldefrist-v4-Hell-selection-1-scaled.png","og:image:secure_url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Beitragsbild-CRA-Meldefrist-v4-Hell-selection-1-scaled.png","og:image:width":2560,"og:image:height":1440,"article:published_time":"2026-09-01T11:13:06+00:00","article:modified_time":"2026-09-17T12:49:14+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"Cyber Resilience Act: 24-Hour Reporting Obligation Art. 14","twitter:description":"Article 14 of the Cyber Resilience Act requires a 24-hour report to CSIRT and ENISA from 2026. Which internal responsibilities must be established beforehand.","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Beitragsbild-CRA-Meldefrist-v4-Hell-selection-1-scaled.png","twitter:label1":"Written by","twitter:data1":"superadmin","twitter:label2":"Est. reading time","twitter:data2":"7 minutes"},"aioseo_meta_data":{"post_id":"70422","title":"Cyber Resilience Act: 24-Hour Reporting Obligation Art. 14","description":"Article 14 of the Cyber Resilience Act requires a 24-hour report to CSIRT and ENISA from 2026. Which internal responsibilities must be established beforehand.","keywords":null,"keyphrases":{"focus":{"keyphrase":"Cyber Resilience Act reporting obligation","score":0,"analysis":[]},"additional":[{"keyphrase":"CSIRT responsibility","score":0,"analysis":[]},{"keyphrase":"24-hour deadline vulnerability","score":0,"analysis":[]},{"keyphrase":"ENISA reporting platform","score":0,"analysis":[]},{"keyphrase":"early warning actively exploited vulnerability","score":0,"analysis":[]},{"keyphrase":"Article 14 Cyber Resilience Act","score":0,"analysis":[]}]},"primary_term":null,"canonical_url":null,"og_title":"Cyber Resilience Act: 24-Hour Reporting Obligation Art. 14","og_description":"Article 14 of the Cyber Resilience Act requires a 24-hour report to CSIRT and ENISA from 2026. Which internal responsibilities must be established beforehand.","og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"Cyber Resilience Act: 24-Hour Reporting Obligation Art. 14","twitter_description":"Article 14 of the Cyber Resilience Act requires a 24-hour report to CSIRT and ENISA from 2026. Which internal responsibilities must be established beforehand.","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-09-17 12:49:19","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-09-02 13:13:06","updated":"2026-09-17 13:13:11","focus_keyword":"Cyber Resilience Act","additional_keywords":[{"word":"CSIRT responsibility","score":74,"items":{"introductionKeyword":{"score":6},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"24-hour deadline vulnerability","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"ENISA reporting platform","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"early warning actively exploited vulnerability","score":78,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"Article 14 Cyber Resilience Act","score":70,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":6},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":2},"imageKeyphrase":{"score":3}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/\" title=\"Regulation &amp; Supervision\">Regulation &amp; Supervision<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t24 Hours to Report: Who Needs to Be Part of the Internal Decision\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/ar\/"},{"label":"Regulation &amp; Supervision","link":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/"},{"label":"24 Hours to Report: Who Needs to Be Part of the Internal Decision","link":"https:\/\/swissgrc.com\/ar\/24-hours-to-report-internal-decision-makers\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70422","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/comments?post=70422"}],"version-history":[{"count":1,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70422\/revisions"}],"predecessor-version":[{"id":70425,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70422\/revisions\/70425"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media\/70424"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media?parent=70422"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/categories?post=70422"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/tags?post=70422"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}