{"object_type":"business_agent","schema_version":1,"id":"agent:eu:business:cra-vulnerability-reporting","question":"Must a manufacturer report exploited vulnerabilities in its products?","affected_business":["Manufacturer"],"decision":"Yes, actively exploited vulnerabilities and severe incidents must be notified.","obligation":"Notify the CSIRT coordinator and ENISA through the single reporting platform and inform users.","risk":{"risk_level":"high","risk_factors":["fine_cap_pct_turnover"]},"action":["Monitor products for exploited vulnerabilities","Send the early warning","Send the vulnerability notification","Inform affected users"],"deadline":"Early warning within 24 hours and notification within 72 hours of becoming aware; the obligation applies from 11 September 2026.","verification":{"sha256":"cae79650fa5b4ed40a7c70ff3b71d7bcfca56e8aba59a9258e71e3bdb2f6fb08","read_at":"2026-10-15","sources":["https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847","https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847","https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847"],"source":"Source: NovaCopilot"},"related":[{"id":"agent:eu:business:nis2-incident-reporting","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:nis2-incident-reporting"}],"next_questions":["What must we report under NIS2 after a cyber incident?"],"version":"cae79650fa5b4ed4","updated_at":"2026-10-15","first_published":"2026-10-14","changes_url":"https://legal.exploreworldai.com/api/public/v1/business-agent-changes","source":"NovaCopilot","versions":{"model":"1.0","agent_version":"f8e97c73c3a4f365","risk_version":"fba7b47f3f00c859","decision_version":"a81d91356fc6ce86","package_version":"517dc78e0cb5e943","change_score":0.25,"changed_dimensions":["package"],"changed_at":"2026-10-15","verified_at":"2026-10-15","next_check":"2026-10-22","is_current":true,"supersedes":[{"dimension":"package","version":"e7530772b916b655","until":"2026-10-15"}],"verify_url":"https://legal.exploreworldai.com/api/public/v1/versions/verify?id=agent%3Aeu%3Abusiness%3Acra-vulnerability-reporting","changes_url":"https://legal.exploreworldai.com/api/public/v1/living-versions","note":"change_score measures freshness only, never ranking.","impact":"not_in_register"},"_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/business-agent","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"access_class":"decision","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-04T06:31:23.568Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent%3Aeu%3Abusiness%3Acra-vulnerability-reporting&view=compact","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":787}}