Free · no sign-up · data stays in your browser
CRA reporting assistant: Article 14 in under five minutes
It is Friday evening, a report comes in, and nobody knows whether the 24-hour clock is running, who the recipient is and what belongs in the notification. This tool answers exactly that — for manufacturers of products with digital elements, from 11 September 2026.
- Deadline clock for 24 h, 72 h and the final report — with the correct anchor per path
- Your entries never leave the browser: no account, no server-side storage
- Ready-made notification text in German and English, plus a case log as evidence
If you want to clarify the legal position first
Five short explainers on the questions that come up before the first notification.
- The deadlines under Article 14 CRA24 hours, 72 hours, final report — and the one difference that is regularly overlooked.
- Vulnerability or incident — which path applies?The distinction decides the mandatory content and the final report deadline.
- Who receives the notification?CSIRT and ENISA simultaneously, submitted via a single platform — which is still being built.
- CRA and NIS2 — when does which apply?Two reporting duties, two roles. Anyone meeting both reports twice.
- What is added from 11 December 2027The reporting duty is the first step. Conformity, documentation and support period follow.
Frequently asked
Questions we get asked a lot
When does the Article 14 CRA reporting obligation apply?
From 11 September 2026. It also covers products already placed on the market — not just new development.
What exactly are the deadlines?
Early warning within 24 hours and a detailed notification within 72 hours, both from becoming aware. The final report differs by case: for an actively exploited vulnerability, 14 days from the corrective or mitigating measure becoming available; for a severe security incident, one month from the 72-hour notification.
Does the final report deadline start when I become aware?
Not for an actively exploited vulnerability. That deadline starts only once the corrective or mitigating measure is available. Until then no clock is running for the final report at all. This is regularly confused in practice — which is why the assistant deliberately shows no countdown here, but a note that the deadline has not started.
Who is the report sent to?
Simultaneously to the CSIRT designated as coordinator of the Member State of your main establishment and to ENISA, submitted via the single reporting platform under Article 16 CRA.
Does the tool submit the report for me?
No. The assistant produces a submission-ready notification text and a log. Submission is made solely by you via the reporting platform or your competent CSIRT. Responsibility for meeting deadlines and for completeness remains with the manufacturer.
Where does the data I enter go?
Into your browser and nowhere else. There are no accounts and no storage on our servers; PDF, JSON and calendar files are produced on your device. That is deliberate: unpublished vulnerabilities are entered here.
Do I have to inform my users as well?
Yes, in parallel with the authority notification and without delay, with sufficient information for protective measures — including mitigation for the period before a patch is available. The assistant produces a separate template for this in German and English.
What does the reporting assistant cost?
Nothing, permanently. There is no sign-up and no feature limit.