This. CRA only means that you need to assess with 24/72h that you are affected or not by a published CVE.

Then there is no time limit to provide a mitigation. It should just be worked out without unnecessary delays. Once a mitigation is published, a report should be submitted with 14 days.