Skip to content
Declarable

CRA Article 14 reporting

The 24-hour clock, timed and drafted for you.

An actively exploited vulnerability or a severe incident has to be reported in three stages. Declarable times each one from the moment you became aware, drafts the text, and keeps the record. You submit it yourself on ENISA’s platform.

Start the Article 14 clockSee pricing

Included in Free, Maker, Studio and Fleet.

Incidents · Demo sensor firmware 1.0.0Example

Actively exploited vulnerability

Became aware 2026-10-02 09:00 UTC

  1. Early warningArt 14(2)(a)

    due 2026-10-03 09:00 UTC

    24 hours after you became aware

  2. NotificationArt 14(2)(b)

    due 2026-10-05 09:00 UTC

    72 hours after you became aware

  3. Final reportArt 14(2)(c)

    due 2026-10-21 09:00 UTC

    14 days after the fix was available

A worked example: the incident is made up; the deadline arithmetic is the code that times real ones.

What it does

Article 14 reporting, in 6 parts.

  1. 01

    All three deadlines, in UTC and your time zone

    The early warning at 24 hours, the notification at 72, and the final report: 14 days after a fix is available for an exploited vulnerability, one month after the notification for a severe incident.

  2. 02

    Draft text for every stage

    Each stage starts from a template that asks only what that stage needs, filled in from what you already recorded.

  3. 03

    Reminders before anything is due

    Reminder emails go to the people you choose, ahead of each deadline. Add the deadlines to your calendar with one file.

  4. 04

    Start from a finding

    Open a report straight from a matched vulnerability. The product, the component and the record carry over; you decide when you became aware.

  5. 05

    Telling your customers

    Article 14(8) asks you to tell affected users. You get the notice in two formats, a place for the recipient list and a log of what you sent. Declarable sends nothing on your behalf.

  6. 06

    Ready before it starts

    A readiness list says what to set up before the clock ever starts. Support periods are tracked per product, with a draft end-of-support notice when one ends.

How it works

Three steps, the same every release.

  1. 1

    Record when you became aware

    Pick an exploited vulnerability or a severe incident and enter the moment you became aware. The deadlines follow from that one instant.

  2. 2

    Fill in each stage as it falls due

    The page shows what is due next and how long is left. Edit the draft for that stage and mark it sent when you have submitted it.

  3. 3

    Keep the record

    Every stage, every edit and the times you entered stay in one incident record, which you can print or export.

What it does not do

  • It does not submit anything to ENISA or a national CSIRT. You submit each stage yourself.
  • It does not decide whether an incident is reportable. It shows what the article says and times it once you decide.

Questions

Questions about Article 14 reporting.

When did Article 14 reporting start?

Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026. The rest of the Cyber Resilience Act applies from 11 December 2027.

Is the Article 14 workflow free?

Yes. It is on every plan, including Free, and it stays on if you cancel.

What is the final-report deadline?

For an actively exploited vulnerability, no later than 14 days after a corrective or mitigating measure is available. For a severe incident, within one month after the notification.

Does Declarable file the report for me?

No. It times the deadlines and drafts the text. You submit each stage on ENISA’s Single Reporting Platform.

The rest of Declarable

What Declarable is, and what it is not

  • A documentation aid. Declarable prepares drafts and checklists for you to review and edit.
  • Not legal advice. For a legal question about your product, ask a lawyer.
  • Not certification. Nobody at Declarable assesses or signs off your product. You sign your own declaration of conformity.
  • Not an assessment body. Some products need an outside assessment body: an product unless its maker fully applies a harmonised standard or one of the alternatives in Article 32(2), and those on the CRA's Annex III class II and Annex IV lists — the higher-risk product categories, where self-assessment is not enough. Declarable is not one. The scope check asks the questions that point to your category.
  • Not a filing agent. Declarable does not file reports for you. You submit them yourself on the ENISA platform.

Source for the assessment lists and when an outside body is needed: Annexes III and IV and Article 32 of Regulation (EU) 2024/2847 (Cyber Resilience Act), as recorded in legal state 2026.10.13-1.

Start with the free tool. Keep the record when you are ready.

Start the Article 14 clockSee pricing