24 hours, 72 hours, 14 days.
Since 11 September 2026, an actively exploited vulnerability or a severe incident starts three clocks. Regulus works out each deadline, prepares what goes in each report and keeps a record of what you sent through the ENISA single reporting platform.
Three steps, no calls.
- 01
Flag it
Mark a vulnerability as actively exploited, or record a severe incident. The clocks start from when you became aware.
- 02
Prepare each report
Early warning within 24 hours, notification within 72, final report within 14 days for vulnerabilities and one month for incidents.
- 03
Keep the record
Reference, date and who sent each stage, ready for the authority and the technical file.
Article 14 reporting in Regulus.
Deadlines worked out
Each of the three stages, counted from the moment of awareness.
Vulnerability tracking
Severity, status and the actively exploited flag that starts the clocks.
ENISA submission log
What was submitted, when and by whom, stage by stage.
SBOM to start from
The components you imported, to see quickly which products a vulnerability touches.
Read more about it.
Our guides on the Cyber Resilience Act, written against the adopted text.
Questions about article 14 reporting.
When do the CRA reporting obligations apply?
Since 11 September 2026, including for products placed on the market before that date.
What are the Article 14 deadlines?
An early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident, a notification within 72 hours, and a final report within 14 days for vulnerabilities or one month for incidents.
Where are CRA reports submitted?
Through the single reporting platform run by ENISA, which routes them to the CSIRT of the relevant Member State and to ENISA.
One file, start to finish.
Scope. Check whether the Cyber Resilience Act applies to your product.
Classification. Classify your product under the Cyber Resilience Act by its core function.
Annex I requirements. Track every Cyber Resilience Act essential requirement of Annex I.
Risk assessment. Build the cybersecurity risk assessment the Cyber Resilience Act requires.
Technical file. Generate the Cyber Resilience Act technical file in editable Word.
Start with your own product.
Free for manufacturers. An expert is one click away when you want one.