CRA reporting obligations apply from 11 September 2026View the timeline
CRA ToolsCheck your product
Reporting Article 14

CRA Reporting Deadline Calculator

Calculate awareness-based reporting deadlines with explicit time zones and final-report triggers. Get a qualified result, follow the reasoning and see what to do next.

Free · No accountSource review: 2026-09-07View official sources
Article 14 applies from 11 September 2026. The 24-hour and 72-hour limits run from awareness. Final-report dates require a different trigger for each event type. This tool calculates dates; it does not submit a report.

Event parameters

0 of 4 answered
Which event are you assessing?
Does the event meet the statutory reporting threshold?

Vulnerability: reliable evidence of malicious exploitation without permission. Severe incident: actual/potential harm to sensitive or important data/functions, or malicious code introduction/execution. This calculator assumes manufacturer reporting under Article 14.

When did the manufacturer become aware?

Use the time sufficient evidence established the qualifying event, not the time a report was drafted.

Time zone (IANA identifier)

For example Europe/Brussels, Europe/London, America/New_York or UTC. Repeated/nonexistent local times during daylight-saving changes are rejected; use the equivalent UTC time with UTC as the zone.

Answers stay in your browser. No account or storage.

How to use this calculator

Article 14 requires reporting without undue delay, with outer limits of 24 hours for an early warning and 72 hours for the main notification. The final-report trigger differs for an actively exploited vulnerability and a severe incident.

Use facts about the specific product, version and supply arrangement. If you cannot establish a condition, select the uncertainty option. The result identifies the limits of the assessment and the evidence needed for your next decision.

Read the guide: Article 14 reportingDesktop softwareIoT & connected devices

Frequently asked questions

Do the clocks stop outside business hours?

The 24-hour and 72-hour windows are elapsed-hour limits. Do not pause them overnight or over a weekend.

Is a security patch required before the early warning?

No. The early warning is due from awareness of the qualifying event. A corrective or mitigating measure is relevant to the vulnerability final-report trigger.

Does this calculator send anything to ENISA?

No. All entered dates and answers are processed locally. You submit the reports separately through the official channel.

Continue your CRA assessment