CRA reporting deadline calculator
Enter when you became aware. See when each Art. 14 report is due at the latest.
Deadlines
The calculator needs JavaScript in your browser. The rules it applies are listed below.
Choose the Member State and enter the moment of awareness to see the deadlines.
Awareness
24 hEarly warning
72 hVulnerability notification
Corrective or mitigating measure available
Starts the 14 days for the final report (Art. 14(2)(c)).
14 daysFinal report
Deadlines follow the strictest EU calendar, never later than the legal limit.
Regulation (EU) 2024/2847, Art. 14 · text checked against the Official Journal on 18 October 2026 · information, not legal advice
What the Regulation says
Deadlines
- Art. 14(1), 14(3)
- The manufacturer notifies an actively exploited vulnerability and a severe incident having an impact on the security of the product simultaneously to the CSIRT designated as coordinator and to ENISA, through the single reporting platform (Art. 16).
- Art. 14(2)(a), 14(4)(a)
- Early warning: without undue delay and in any event within 24 hours of becoming aware.
- Art. 14(2)(b), 14(4)(b)
- Notification: without undue delay and in any event within 72 hours of becoming aware, unless the information was already submitted.
- Art. 14(2)(c)
- Final report on an actively exploited vulnerability: no later than 14 days after a corrective or mitigating measure is available.
- Art. 14(4)(c)
- Final report on a severe incident: within one month after the incident notification.
- Art. 14(5)
- An incident is severe when it affects, or can affect, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or when it has led, or can lead, to malicious code being introduced or executed. You decide whether this is the case.
Who receives the report
- Art. 14(7)
- The report goes to the CSIRT designated as coordinator of the Member State where the manufacturer has its main establishment in the Union. Without one, the article names in turn the Member State of the authorised representative, of the importer, of the distributor, or the one with the most users.
- Art. 14(6), 14(8)
- The CSIRT may ask for an intermediate report; the Regulation sets no fixed time for it. After becoming aware, the manufacturer also informs the impacted users, and where appropriate all users.
Scope and dates
- Art. 71(2), Art. 69(3)
- The reporting obligation applies from 11 September 2026; administrative fines under Article 64 apply from 11 December 2027. Art. 14 also applies to products placed on the market before 11 December 2027; the rules on notified bodies (Chapter IV) have applied since 11 June 2026. Penalties and competent authorities are set by national law.
- Art. 64(10)
- Micro and small enterprises are not fined for missing the 24-hour early warning (Art. 14(2)(a) and 14(4)(a); Art. 64(10) as corrected by OJ L 2025/90555).
How the calculator counts
- Each report is due without undue delay. The times shown are the latest moments the Regulation allows, not targets.
- The 24 and 72 hours are periods in hours: elapsed hours from the exact moment of awareness, computed in UTC and shown in local time. A clock change in between does not move the deadline; the calculator says so at that station.
- Days and months are counted as in Regulation (EEC, Euratom) No 1182/71. The day the measure became available, or the day the notification was submitted, is not counted. The period ends at the end of its last day, in the time zone of the Member State of the CSIRT designated as coordinator. A one-month period ends on the same date in the next month. If that month has no such date, it ends on that month's last day.
- Under Art. 3(4) of Regulation (EEC, Euratom) No 1182/71, a period in days or months whose last day is a Saturday, Sunday or public holiday may end at the end of the next working day. This does not apply to periods in hours. The calculator shows the strict date as the deadline and the next working day separately as a possible extension; it knows weekends only, not public holidays.
- If a corrective or mitigating measure was available before the moment of awareness, the 14 days are counted from awareness, because the duty arises only on awareness; counted from the measure, they may already have passed, so report without undue delay.
- ENISA's single reporting platform may show its own 72-hour counter, which starts 48 hours after the early warning was submitted. The Regulation counts the 72 hours from becoming aware (Art. 14(2)(b)); the calculator follows the Regulation.
In crAcken each case keeps these deadlines together with the awareness record behind them: who decided, when, and on what basis.