Tier 0 · Free
Article 14 exposure check
$0 · 20 min
Twenty minutes on your product line and EU exposure. You get a one-page written exposure memo within 48 hours. No pitch.
Your first 24-hour report shouldn’t be your first attempt.
PSIRT and CRA reporting readiness for component suppliers — built inside the quality system you already run, as 8D, mapped to IEC 62443-4-1 Practices 6 and 7.
Art. 14 live — 11 Sep 2026
—
Scope
Your fielded fleet — no grandfathering (Art. 69(3))
Route
The quality system you already have
24 h early warning · 72 h notification · 14 d final report
No grandfathering for reporting — Art. 69(3)
Notified bodies designated today: zero
CE-marking deadline: Dec 2027 — reporting comes first
Verified 24 Jul 2026. Regulations change; we re-verify before every engagement.
01
The offers — fixed prices, decision-by dates tied to 11 Sep
Tier 1 · 3–5 days
SRP Readiness Sprint
$3,500 · $2,500 founding
Founding rate for the first three clients, in exchange for a named reference.
- ENISA Single Reporting Platform registration
- Named reporter and deputy
- The 24 h / 72 h / 14 d runbook with fill-in templates
- One tabletop dry-run
- Evidence log opened
Tier 2 · 2 weeks
PSIRT-in-QMS Sprint
$14–18k
The full IEC 62443-4-1 Practice 6 + 7 build inside your QMS: charter, intake, triage, disclosure policy, advisory templates, and the audit evidence pack.
After a sprint, most clients keep the process running through a fractional PSIRT retainer — that conversation happens inside the sprint, not before.
02
The 8D of an Article 14 report
| 8D step | CRA obligation | Clock | 62443-4-1 | What gets produced |
|---|---|---|---|---|
| D0 Plan & intake | You become aware of an actively exploited vulnerability — the reporting duty starts (Art. 14(1)) | 24 h | P6 · DM-1 | Intake record; early-warning submission to the SRP; clock log opened |
| D1 Team | A named reporter and deputy who can act inside the window | standing | P6 · DM-1 | RACI, on-call rota, escalation path |
| D2 Describe | Vulnerability notification: nature, severity, affected products (Art. 14(2)(b)) | 72 h | P6 · DM-2/3 | Characterized defect: what, where, since when, exploitation status |
| D3 Contain | Interim measures users can apply now; users informed | ASAP | P6 · DM-4 | Mitigation advisory: workaround, configuration change, or restriction |
| D4 Root cause | Why it was introduced and why it wasn’t detected | — | P6 · DM-3 | Systemic root-cause record, twice over |
| D5 Corrective action | A security update that addresses the verified cause | — | P7 · SUM | The fix, qualified for the fielded fleet |
| D6 Validate | Evidence the fix closes the path it claims to close | — | P7 · SUM | Regression run plus targeted re-test of the patched path |
| D7 Prevent recurrence | The process fix behind the product fix | — | P6 · DM-5/6 | Updated coding standard, new CI detection, amended threat model |
| D8 Close & recognize | Final report: description, severity, measures taken (Art. 14(2)(c)) | 14 d | P6 · DM-5 | Final report filed; reporter credited; the 8D record archived as audit evidence |
03
Straight answers
Are you a notified body?
No — advisory only. You remain manufacturer of record; we make you ready for whoever assesses you.
We’re a component supplier — isn’t our customer the manufacturer?
If you place it on the EU market under your own brand, you are the manufacturer for that product — and your customers flow the requirement down regardless.
Our products shipped years ago.
Product requirements are grandfathered to Dec 2027; Article 14 explicitly is not (Art. 69(3)).
Why fixed prices?
Because scoping surprises are a process failure.
04
Who runs this
Portrait — Matthew Macri
Principal
Matthew Macri led a CRA / IEC 62443 programme inside a BC industrial manufacturer from zero to signed charter — intake, triage, disclosure, and the evidence trail behind them. He runs the process he sells. Completing ISA/IEC 62443 certification. Based in British Columbia; works in client time zones.
Book the 20-minute exposure check
Twenty minutes, a straight read on your Article 14 exposure, and a one-page written memo within 48 hours. No pitch.
Booking
Prefer email — matt@firstarticle.ca. Include your product line and where it ships; you’ll get times within one business day.
Email instead