CRA / managed vulnerability disclosure
Cyber Resilience Act.
Managed VDP.
A connected process.
Give product vulnerability reports a clear route from external discovery to the people who can act. Hackrate managed VDP brings structured intake, human validation, researcher communication, and a traceable engineering handoff into your disclosure process.
External report.
A clear internal owner.
- Receive
Structured product vulnerability intake
- Validate and coordinate
Evidence, impact, and researcher dialogue
- Route to the manufacturer
Risk decisions, fixes, and reporting assessment
MANAGED INTAKE / MANUFACTURER ACCOUNTABILITY
PUT DISCLOSURE INTO OPERATION
A policy needs
a working process.
The CRA addresses cybersecurity for products with digital elements made available on the EU market. Its vulnerability handling framework includes coordinated disclosure and a reporting contact. A published policy is a starting point; the operating process needs people, evidence, and an internal destination for findings.
Hackrate managed VDP helps connect that external reporting channel to daily security work. Agree how submissions are received, reviewed, clarified, escalated, and handed to the product team. Keep the researcher conversation and technical context attached to the report as your team decides the next action.
Scope and requirements: Commission summary and Regulation (EU) 2024/2847.
A clear reporting channel
Give external reporters a structured way to reach the right team. Capture the affected product, version, technical description, evidence, and a route for clarification so a potentially important report does not disappear into a general support inbox.
Human validation and context
Hackrate reviews incoming submissions for relevance, reproducibility, duplicates, and demonstrated impact within the agreed service. Your product team contributes the context needed to distinguish a technical finding from its effect on customers and supported product versions.
Coordinated communication
Keep questions, supporting evidence, and researcher updates connected to the finding. An agreed communication process helps your security, product, and engineering teams work from the same record while maintaining a professional relationship with the reporter.
A handoff with an owner
Connect validated findings to the team responsible for the next action. Keep the assessment, outstanding questions, decisions, and remediation updates together, with verification and disclosure coordination included where agreed for the engagement.
CONNECT THE REQUIREMENT TO THE WORK
Where managed VDP
supports your CRA process.
Define the service contribution and the internal owner together. External report handling should connect to your product security program, with clear responsibilities at each handoff.
Policy and reporting contact
A coordinated disclosure policy and a discoverable vulnerability contact are part of the CRA framework.
Managed VDP support
A structured intake channel and agreed reporting rules can put the external reporting process into operation.
Manufacturer ownership
Your organization adopts and publishes its policy, contact details, and product scope.
Assessment and prioritization
Reported vulnerabilities need a handling process that reaches the relevant product owners.
Managed VDP support
Hackrate can validate reports, assess technical impact, request evidence, and coordinate reporter communication.
Manufacturer ownership
Your team adds product context and makes risk, urgency, and notification decisions.
Records and remediation handoff
Product vulnerability handling needs documentation and a route to action.
Managed VDP support
Centralized reports can retain findings, discussions, status information, and the agreed technical handoff.
Manufacturer ownership
Your engineers implement fixes; your organization maintains its required product documentation.
Disclosure and follow-through
Vulnerability handling extends beyond accepting a report.
Managed VDP support
Coordinate researcher updates, agreed verification, and eligible CVE support when a public identifier is useful.
Manufacturer ownership
Your organization controls security updates, user advisories, publication decisions, and authority notifications.
CRA references: Annex I, Part II and Annex II. Read the Regulation.
FROM EXTERNAL REPORT TO PRODUCT ACTION
One connected record.
Five practical stages.
Adapt the workflow to your products, reporting channels, and internal ownership. Urgent escalation runs alongside assessment and is not held until routine validation finishes.
Receive the report
Use the agreed reporting form and product scope. Capture affected versions, reproduction information, evidence, and reporter contact details where provided. Identify the internal product owner and the route for urgent escalation from the beginning.
Validate and add context
Hackrate reviews the submission and requests clarification where needed. Assess what the evidence supports, whether the issue is already known, and which product conditions matter. Additional reproduction activity needs the appropriate authorization and access.
Escalate for assessment
Route findings and evidence of possible exploitation to designated manufacturer contacts. Your team assesses product impact, urgency, and any statutory reporting trigger. Urgent information should be escalated while assessment continues, without waiting for a report to complete triage.
Remediate and track
Your engineers investigate and implement the fix or mitigation. Keep ownership, affected products, decisions, and progress connected to the finding. Where verification is agreed, record the outcome against the original behavior and distinguish it from initial validation.
Coordinate disclosure
Agree researcher communication and publication timing with the relevant owners. Prepare the technical information needed for the chosen disclosure process. Discuss eligible CVE coordination when useful, while keeping public disclosure and regulatory notifications as separate decisions.
TWO DIFFERENT MILESTONES
Know the dates.
Keep reporting distinct.
Article 14 manufacturer reporting applies from 11 September 2026. The CRA’s main provisions apply from 11 December 2027.
2026
Manufacturer reporting under Article 14
2027
The CRA’s main provisions
When an Article 14 reporting trigger applies
For relevant actively exploited vulnerabilities and severe incidents, manufacturer awareness starts the reporting clock. Act without undue delay, within the applicable outer limits.
Early warning
From the manufacturer becoming aware
Notification
From the manufacturer becoming aware
Actively exploited vulnerability: within 14 days after a corrective or mitigating measure is available.
Severe incident: within one month after the incident notification.
Deadlines and triggers: Commission reporting guidance.
Two channels, different purposes.
Hackrate receives external vulnerability disclosures. Statutory notifications use the official CRA Single Reporting Platform. A validated research finding is not automatically reportable, and the manufacturer owns that assessment. The regulatory clock does not wait for a ticket, CVE, or service workflow to finish.
A SERVICE WITH A DEFINED CONTRIBUTION
Clear support.
Clear manufacturer ownership.
Agree the operating arrangement before launch, including supported channels, authorized validation, escalation contacts, technical handoff, and the evidence your team needs.
Hackrate’s agreed role
- Provide structured external intake and review the submissions received through the agreed channel.
- Validate technical claims, request evidence, and add severity and impact context.
- Coordinate researcher communication and route findings to your designated contacts.
- Keep assessment and discussion records connected, with verification and disclosure support where included.
Your organization’s role
- Determine applicability and product scope, and appoint people authorized to make decisions.
- Assess reporting triggers, meet statutory deadlines, and submit required notifications.
- Implement and distribute fixes, manage product support, and communicate with affected users.
- Own product security, technical documentation, and the required conformity process.
Managed VDP supports a defined part of the program. Broader work such as secure design, risk assessment, component documentation, security updates, and conformity remains with the manufacturer. See the Commission’s manufacturer overview.
MAKE THE FIRST CONVERSATION USEFUL
Bring your products,
owners, and reporting paths.
A useful starting discussion covers how your organization receives reports today and what should happen when an important finding arrives.
Product scope
List the products and supported versions, relevant components, reporting channels, and known internal processes.
Decision owners
Name product, security, engineering, legal, and management contacts. Set a route for urgent information and backup ownership.
Working access
Agree what validation can involve, where reproduction is safe, and how sensitive evidence should be handled.
Service expectations
Define included activities, communication, escalation, handoff, reporting, and any agreed verification or disclosure work.
Also assessing organizational cybersecurity obligations? Explore how vulnerability handling and managed VDP support NIS2, with distinct scope and incident reporting responsibilities. For products supplied to the UK market, see UK PSTI compliance support and disclosure requirements.
YOUR QUESTIONS, ANSWERED
CRA & managed
VDP FAQs.
Understand the service contribution, reporting boundaries, and the next step for your team.
Discuss your requirementsHow does managed VDP support CRA vulnerability handling?
Hackrate managed VDP supports external vulnerability intake, report validation, researcher communication, technical assessment, and a documented handoff to your team. Agree which activities, escalation routes, reporting, and verification are included. This operating process can support your wider product security work while your organization retains its manufacturer responsibilities.
Does a managed VDP make our product CRA compliant?
A managed VDP supports part of vulnerability handling. It does not establish product conformity or replace your wider CRA work. Your organization remains responsible for applicability, product security, remediation, statutory reporting, and the required conformity process. Define the service contribution within your broader implementation plan.
What are the key CRA application dates?
Manufacturer reporting obligations under Article 14 apply from 11 September 2026. The CRA’s main provisions apply from 11 December 2027. These are different milestones: the later date is not a reason to postpone an applicable reporting process.
Does every vulnerability report trigger an authority notification?
No. An incoming report is not automatically an Article 14 notification. The manufacturer assesses whether it concerns an actively exploited vulnerability or a qualifying severe incident. Good-faith research without evidence of prior malicious exploitation does not automatically establish that trigger. Escalate relevant evidence promptly so the responsible team can decide.
Does Hackrate submit CRA notifications to ENISA for us?
A Hackrate reporting form is an external disclosure intake channel. Statutory CRA notifications use the official Single Reporting Platform and remain the manufacturer’s responsibility. The service does not imply an automatic submission integration. Hackrate can provide the technical information and agreed coordination your designated team needs for its assessment.
Is every SaaS application or website covered by the CRA?
Standalone SaaS is not automatically a product with digital elements under the CRA. Necessary remote processing developed by, or under the responsibility of, a product manufacturer may be relevant to scope. Assess your product, market role, dependencies, and exclusions against the official guidance rather than treating every online service alike.
Do we need a CVE for every report?
No. A CVE is not required for every incoming finding. Hackrate can discuss CVE ID and record coordination for eligible vulnerabilities when a public identifier is appropriate. A CVE does not replace a security fix, a disclosure decision, or a required regulatory notification.
Does a managed VDP authorize active testing or promise rewards?
A managed VDP provides a channel for incoming disclosures and agreed report handling. It does not itself invite active testing or create a bounty commitment. Any testing authorization, access, reward rules, and additional verification work must follow the applicable program and engagement terms.
OFFICIAL REFERENCES
Read the source.
Scope your next step.
Reviewed 25 October 2026
- Regulation (EU) 2024/2847 The CRA legal text, including Annex I vulnerability handling requirements.
- European Commission: CRA summary Product scope, manufacturer obligations, and application dates.
- European Commission: reporting obligations Article 14 triggers, notification deadlines, and the reporting channel.
- European Commission: implementation FAQs Further scope and reporting clarifications, including SaaS and research findings.
- ENISA: Single Reporting Platform Official platform information for statutory notifications.
Use the official text and guidance for your applicability and legal assessment. Discuss the managed VDP service scope separately with Hackrate.
CONNECT DISCLOSURE TO DAILY OPERATIONS
Build the process.
Give every finding an owner.
Talk through your product scope, incoming reports, and internal responsibilities. Shape a managed vulnerability disclosure process that supports your CRA implementation work.
Discuss Your CRA Disclosure Process
Hackrate
Our platform helps companies to identify software vulnerabilities in a cost-efficient way. It provides a secure and centralized view of ethical hacking projects for your company.
US Patent Applied for HackGATE #63/645,845
Products
From the Blog
-
Hackrate Ranked 1st in Hungary and 22nd Globally at Hack The Box’s Global Cyber Skills Benchmark 2026
May 29 • 13 min read
-
Press release: Hackrate becomes Hungary’s first CVE Numbering Authority
Jan 13 • 5 min read ★
-
Let 2026 be the year bug bounty becomes part of how you build and operate
Jan 05 • 4 min read
Numbering Authority