CRA reporting: spreadsheet vs tool vs consultant

You can track Cyber Resilience Act reporting in a spreadsheet, with a dedicated tool such as CRA Reporting Kit, or by hiring a consultant or law firm. Each is the right choice for some companies. This page compares them honestly.

What you are trying to do

Whatever you choose, the job is the same. Since 11 September 2026, when you become aware of an actively exploited vulnerability or a severe incident in your product, you send an early warning within 24 hours, a notification within 72 hours and a final report later, through the single reporting platform [1][2]. You also inform users. The method you pick has to work on a Saturday night.

The comparison

	Spreadsheet	CRA Reporting Kit	Consultant or law firm
Cost	Free if you already have the software	$199 one-time	Varies widely; usually priced per hour or as a retainer
Setup time	Hours to build formulas and templates yourself	Minutes: open the file	Days to weeks to agree scope and contract
Deadline tracking	Only as good as your formulas	Built in, with due-soon and overdue warnings	Handled by the adviser if they are on call
Report drafts	You write them	Drafts for each report and a user notice	Written or reviewed by the adviser
Data privacy	Depends where the file lives; cloud sheets are shared by link	Stays in your browser, no upload	Shared with a third party under their confidentiality terms
Legal judgement	None	None, not legal advice	Yes, this is what you pay for
Weekend cover	Your own staff	Your own staff	Only if the contract includes it

Spreadsheet

Good for: companies with one product, a technical founder who likes building their own tools, and very low expected volume.

Risks: date formulas break when someone edits a cell, time zones get mixed up, and there is no warning when a deadline approaches unless you build one. The two final report deadlines also run from different moments: 14 days after a fix is available for a vulnerability, one month after the notification for an incident [2]. That is easy to get wrong in a quick sheet. If the sheet sits in a shared cloud folder, details of an unpatched exploited flaw may be visible to more people than you intend.

A dedicated tool

Good for: small and medium manufacturers who will do the reporting themselves and want the deadlines, drafts and record in one place without building it.

Limits: CRA Reporting Kit does not submit reports, does not decide whether something counts as actively exploited, and does not give legal advice. It keeps time and prepares text. You still need people who can act within 24 hours.

Consultant or law firm

Good for: this is the better choice when the stakes or the uncertainty are high. Choose an adviser when:

You are unsure whether you are a manufacturer, importer or distributor for a product.
An incident may also trigger other duties, such as personal data breach rules or sector rules, and the reports need to line up.
The incident could lead to liability claims, press attention or contact with regulators beyond the report itself.
You have many products and Member States and need a full process designed and audited.

Limits: cost, and availability. Check that the contract covers response within hours, including weekends, because the early warning does not wait for office hours [2].

Combining them

These are not exclusive. A common setup is to run reporting in-house with a tool or sheet, and keep an adviser for the hard calls. Many security consultants also use a tool to track client cases.

How to decide

If you have legal uncertainty about your role or a high-impact incident, talk to an adviser.
If you will do the reporting yourselves and want it ready today, use a tool.
If you have one product and time to build and test your own sheet, a spreadsheet can work.

More detail: the first 24 hours, the reporting obligations and the vulnerability handling checklist.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.