When a supplier reports an incident

Executive summary

A supplier’s short incident alert may leave the customer unable to identify affected systems. Agree a minimum first-notice dataset, an update cadence and contacts with deputies.

For supply chains involving CRA-covered EU products, distinguish the manufacturer’s regulatory duty from the supplier’s contractual cooperation obligation. Specify known facts and unresolved questions separately. A maintained contact schedule can be as useful in the first hours as a carefully negotiated liability clause.

Sources

European Commission · CRA reporting obligations

https://digital-strategy.ec.europa.eu/en/policies/cra-reporting