Reporting obligations have applied since 11 September 2026. Could your team run a 24-hour clock tonight?
If a vulnerability in your product is actively exploited, you have 24 hours to send an early warning to your national CSIRT and ENISA, 72 hours for the notification, and you must inform your users. Most teams find out at hour one that they don't know which CSIRT, what the notification must contain, or how to reach their users in time.
The pack is generated for your role, product class and Member State: a reporting runbook with your deadlines in local time, a decision tree for “is this reportable?”, notification templates you can edit (DOCX), a user notice, a roles matrix, an evidence log, your obligation calendar and a pre-incident checklist. Every section cites the article it derives from.
It does not replace your lawyer or your conformity assessment. It makes the first 24 hours executable.
What is inside
Reporting runbook
The 24h / 72h / 14-day timeline with your deadlines in local time, the CSIRT that receives them, and the people on your side already named.
Decision tree: is this reportable?
Decide, under pressure, whether what you are looking at triggers the duty to report — ending in notify, record it, or ask a lawyer.
Notification templates
The text to send at each step, with your details filled in and the gaps marked — editable, because the worst moment to write your first notification is hour 20 of 24.
Notice to users
The notice to users required by Article 14(8), written for the channels you told us you actually have.
Role matrix
Who detects, who decides, who notifies, who speaks to users, who records — each with a stand-in, because someone is always on holiday.
Evidence log
A log that proves, afterwards, that the deadlines were met: when you became aware, when each submission went out, and the reference it came back with.
Obligation calendar
The dates that apply to your product class, and what has to exist by each of them.
Pre-incident checklist
What has to exist before an incident — SBOM, disclosure policy, public contact, monitoring, out-of-hours cover, a channel to users — ordered by the gaps your answers revealed.
€199 one-time · 12 months of updates
When the ENISA SRP glossary or the Commission's reporting guidance changes, we regenerate your pack and e-mail you what changed — for 12 months after purchase.
Not on sale yet — run the check and we will tell you when it is.
This is an automated regulatory assessment for orientation purposes, not legal advice. Final scope and classification depend on the specifics of your product and applicable guidance.