> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/17.md).

# Art. 17 — Other provisions related to reporting

CRA Article 17 — Other provisions related to reporting. Regulation (EU) 2024/2847, Chapter II — Obligations of economic operators and provisions in relation to free and open-source software.

1. ENISA may submit to the European cyber crisis liaison organisation network (EU-CyCLONe) established under Article 16 of Directive (EU) 2022/2555 information notified pursuant to [Article 14(1)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/14.md) and (3) and [Article 15(1)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/15.md) and (2) of this Regulation if such information is relevant for the coordinated management of large-scale [cybersecurity](https://headlesslaw.com/definitions/cra/cybersecurity/) incidents and crises at an operational level. For the purpose of determining such relevance, ENISA may consider technical analyses performed by the CSIRTs network, where available.
2. Where public awareness is necessary to prevent or mitigate a severe [incident having an impact on the security of the product with digital elements](https://headlesslaw.com/definitions/cra/incident-having-an-impact-on-the-security-of-the-product-with-digital-elements/) or to handle an ongoing incident, or where disclosure of the incident is otherwise in the public interest, the [CSIRT designated as coordinator](https://headlesslaw.com/definitions/cra/csirt-designated-as-coordinator/) of the relevant Member State may, after consulting the [manufacturer](https://headlesslaw.com/definitions/cra/manufacturer/) concerned and, where appropriate, in cooperation with ENISA, inform the public about the incident or require the manufacturer to do so.
3. ENISA, on the basis of the notifications received pursuant to [Article 14(1)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/14.md) and (3) and [Article 15(1)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/15.md) and (2) of this Regulation, shall prepare, every 24 months, a technical report on emerging trends regarding cybersecurity risks in products with digital elements and submit it to the Cooperation Group established pursuant to Article 14 of Directive (EU) 2022/2555. The first such report shall be submitted within 24 months of the date of application of the obligations laid down in [Article 14(1)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/14.md) and (3) of this Regulation. ENISA shall include relevant information from its technical reports in its report on the state of cybersecurity in the Union pursuant to Article 18 of Directive (EU) 2022/2555.
4. The mere act of notification in accordance with [Article 14(1)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/14.md) and (3) or [Article 15(1)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/15.md) and (2) shall not subject the notifying natural or legal person to increased liability.
5. After a security update or another form of corrective or mitigating measure is available, ENISA shall, in agreement with the manufacturer of the [product with digital elements](https://headlesslaw.com/definitions/cra/product-with-digital-elements/) concerned, add the publicly known [vulnerability](https://headlesslaw.com/definitions/cra/vulnerability/) notified pursuant to [Article 14(1)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/14.md) or [Article 15(1)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/15.md) of this Regulation to the European vulnerability database established pursuant to Article 12(2) of Directive (EU) 2022/2555.
6. The CSIRTs designated as coordinators shall provide helpdesk support in relation to the reporting obligations pursuant to [Article 14](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/14.md) to manufacturers and in particular manufacturers that qualify as microenterprises or as small or medium-sized enterprises.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://www.mica.wtf/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/17.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.