24 hours to report. Be ready before it happens.
Track every Cyber Resilience Act reporting deadline and draft each report. One offline file for manufacturers of connected products and software.
What the law asks, since 11 September 2026
- Who: every manufacturer of a product with digital elements on the EU market. That includes products already sold before September 2026.
- What: actively exploited vulnerabilities and severe incidents that affect the security of the product.
- When: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report later.
- Where: ENISA's Single Reporting Platform, to the CSIRT of your main establishment and to ENISA.
What is inside
Start the clock
Open a case the moment you become aware. Every deadline is set for you.
See what is due
Overdue and due-soon warnings for the early warning, the notification and the final report: 14 days after a fix for vulnerabilities, one month after the notification for incidents.
Draft each report
A draft with the content Article 14 asks for, ready to copy into the reporting platform.
Tell your users
A plain security notice with what happened and what they should do.
Readiness check
Eight points to find out if you can report on a Sunday night.
Why offline
Details of an unpatched, actively exploited vulnerability are the last thing you want in another cloud tool. This kit runs in your browser, with no server, account or upload.
Who it is for
- Small hardware and IoT makers selling in the EU
- Software companies and app makers
- Security leads and consultants who handle reporting for clients
Guides
- CRA 24-hour reporting: what to do in the first day after an actively exploited vulnerability, with a template.
- Reporting obligations since September 2026: who reports what, when and where.
- Vulnerability handling and SBOM checklist: the groundwork that makes 24-hour reporting possible.
- Spreadsheet vs tool vs consultant: an honest comparison of cost, time, privacy and risk.
Get the kit
$199 one-time
- One HTML file, works offline in any browser
- No account, no upload, no subscription
- Free updates when the guidance changes
You get the file and an invoice within one working day.
Questions
Does this submit reports for us?
No. You submit through ENISA's Single Reporting Platform. The kit keeps the deadlines and prepares the text.
Does it make us compliant?
No tool can promise that. The kit helps you meet the reporting deadlines of Article 14. Check the official guidance and the platform's fields.
Where is our data stored?
Only in your browser. Export your case file to keep a record or share it with your team.