CRA vulnerability forwarding
Importers and distributors forward vulnerabilities to the manufacturer — Article 14 ENISA filing is the manufacturer’s job
CRALedger Duty Records (Shopify App Store) is a Shopify app that, as the live listing states, tracks CRA product duties, Article 14 incident deadlines, encrypted ENISA SRP draft packs, vulnerability forwarding, and audit records — including product roles, checklists and open record gaps, and exportable record packs with chronological audit evidence. It does not submit ENISA notifications, determine legal status, or provide legal advice. Not a CE-marking factory.
Related: EUDR Records Manager — DDS reference numbers on supplier lots.
Free check first: CRA role and scope self-check runs in your browser and sends nothing. Describe a product and your role and see which articles of Regulation (EU) 2024/2847 to read.
Stocking a connected product is not the same as opening an ENISA Single Reporting Platform ticket. If you are an importer or distributor, a vulnerability you become aware of is a notice to the manufacturer. Article 14 filing on ENISA is the manufacturer’s reporting job. Confirm the live articles. This page is not legal advice.
Two different CRA jobs — manufacturer Article 14 vs importer/distributor notice
Do not treat this page as a substitute for Regulation (EU) 2024/2847. The live text (HTTP 200 at PR time) still numbers these as Article 14 (Reporting obligations of manufacturers), Article 19 (Obligations of importers), and Article 20 (Obligations of distributors).
Manufacturer — Article 14. “A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that actively exploited vulnerability via the single reporting platform established pursuant to Article 16.” Article 14 also requires manufacturers to notify severe incidents having an impact on the security of the product with digital elements via that same platform. Confirm the live article for clocks and content, not this extract.
The Commission’s CRA reporting page (HTTP 200 at PR time) states: “As of 11 September 2026, manufacturers are required to report actively exploited vulnerabilities and severe incidents impacting the security of products with digital elements.” Manufacturers “report only once through the CRA Single Reporting Platform (SRP).”
ENISA’s Single Reporting Platform page (HTTP 200 at PR time; this is the stable URL after the older product-security path) states that the SRP is the online tool for manufacturers to meet those reporting obligations, and that “From 11 September 2026, manufacturers are required to submit these mandatory notifications through the SRP.”
Importer (Article 19) / distributor (Article 20). Upon becoming aware of a vulnerability in the product with digital elements, importers “shall inform the manufacturer without undue delay about that vulnerability.” Distributors have the same manufacturer-notice duty. Where the product presents a significant cybersecurity risk, importers and distributors shall also immediately inform the relevant market-surveillance authorities of the Member States in which they have made the product available. Read Articles 19(5) and 20(4) on EUR-Lex for the live sentences. That notice path is not the ordinary Article 14 SRP filing.
Stocking connected devices does not, by itself, mean you open an SRP ticket. Counsel decides who files on ENISA for that SKU.
Role first — this page does not decide manufacturer vs importer vs distributor
Counsel or compliance decides whether you are a manufacturer, importer, or distributor for each SKU — including cases where an importer or distributor takes on manufacturer duties. This page does not decide that role. For the product-role file, use the sibling Does the CRA apply to my store, and in which role?.
Keep the role on the SKU before a vulnerability notice is due. Do not assume “I import connected products, therefore I file Article 14.”
Shopify ops — role plus notice evidence, without invented Admin fields
At a high level, keep a per-SKU role and evidence that a vulnerability notice was escalated to the manufacturer (and to market-surveillance authorities when that extra step is required). That is an operations file, not an ENISA login.
This page does not prescribe metafield namespaces, theme blocks, or Admin fields. The live listing does not name those surfaces. Confirm whatever record you keep against the SKU you actually sell.
Not the same as the duty file, the support-period offer, GPSR, or FIC
- Not the duty-records sibling. That URL is the product file, Article 14 clocks, and encrypted ENISA SRP draft packs you still file on ENISA — manufacturer reporting, not importer/distributor manufacturer-notice.
- Not the support-period sibling. That URL is Art. 13(19) purchase-time end date on the product page.
- Not GPSR responsible-person fields. That job is manufacturer fields vs responsible person.
- Not an FIC food-operator name-and-address line. That job is the food business operator before purchase.
App path — listing jobs only, including vulnerability forwarding
Re-fetched the live listing at PR time (HTTP 200). Meta / SoftwareApplication description: “Track CRA product duties, Article 14 incident deadlines, encrypted ENISA SRP draft packs, vulnerability forwarding, and audit records.” Body jobs, plan-neutral: track product roles, checklists and open record gaps; Article 14 deadlines; encrypted ENISA SRP drafts; export record packs and chronological audit evidence. The listing still names those encrypted ENISA SRP draft packs among the jobs; this page does not attach them to a price matrix.
Soft-sell those listed jobs only. This page does not describe how vulnerability forwarding is implemented (no UI, API, or email claim). The listing phrase is the whole claim.
- Open the CRALedger Duty Records listing (
apps.shopify.com/craledger-duty-records) and install it on the store that sells in-scope products with digital elements. - Record the product role, checklist, and open record gaps.
- Track Article 14 deadlines and keep encrypted ENISA SRP draft packs as the listing names them — still file manufacturer notifications on ENISA, not in the app.
- Keep vulnerability forwarding and audit/export among the listed jobs. If you are an importer or distributor, the legal notice still goes to the manufacturer (and authorities when required).
The app does not submit ENISA notifications and does not determine legal status. This page is not legal advice.
What this page is not
- Not legal advice, a role determination, or a CRA compliance certification.
- Not an ENISA login guide, CSIRT portal, or Assigned Representative walkthrough. Filing stays on ENISA’s platform for the manufacturer’s Article 14 job.
- Not GPSR. That path is GPSR manufacturer fields vs responsible person.
- Not Agentic commerce / GTIN catalog work. Those paths are agentic catalog readiness and GTIN / barcode for AI shopping.
- Not a CE-marking factory and not a claim that stocking connected devices equals an SRP ticket.
Related pages
- Cyber Resilience Act duty records — Article 14 product file, roles, ENISA draft packs you still file on ENISA
- CRA support period on the Shopify product page — Art. 13(19) at purchase; not this notice path
- Commission CRA reporting obligations — manufacturer reporting from 11 September 2026
- ENISA Single Reporting Platform (SRP)
- Regulation (EU) 2024/2847 on EUR-Lex — Articles 14, 19, and 20
- CRALedger Duty Records — live App Store listing
- Shopify apps hub — CRALedger Duty Records
Not legal advice. Not a compliance guarantee. Not an ENISA filing. Confirm Regulation (EU) 2024/2847 Articles 14, 19, and 20 before you treat a SKU’s notice path as manufacturer SRP filing or manufacturer-notice. The app stores duty records you enter; it does not submit notifications or determine legal status.