Free tool · no account needed

Article 14 clock

The three reporting deadlines for an exploited vulnerability or a severe incident, in your time zone and in UTC.

Since 11 September 2026 the requires manufacturers to report an or a severe incident to ENISA Single Reporting Platformthe reporting platform, in three stages (Regulation (EU) 2024/2847, Article 14).

What happened?

Actively exploited vulnerabilityA flaw in your product that an attacker is already using. There is reliable evidence of it being used on a system without the owner’s permission. (Art 3(42), Art 14(1))A flaw in your product that an attacker is already using.

What this means

A flaw in your product that an attacker is already using. There is reliable evidence of it being used on a system without the owner’s permission. (Art 3(42), Art 14(1))

Severe incidentA security incident that harms, or could harm, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or that has led, or could lead, to malicious code being introduced or run in the product or in a user's network and information systems; you must report it under Article 14. (Article 14(3) and (5))An incident that harms, or could harm, how your product protects data or functions.

What this means

A security incident that harms, or could harm, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or that has led, or could lead, to malicious code being introduced or run in the product or in a user's network and information systems; you must report it under Article 14. (Article 14(3) and (5))

Time zone

The zone your times are entered in and the deadlines are shown in. Starts as this browser's zone.

When did you become aware?required

The moment you had reasonable certainty it was happening. All three clocks start here.

Fix or mitigation available since (optional)

When a corrective or mitigating measure became available. The final report is due 14 days after it.

Your deadlines

Enter when you became aware to see the three deadlines.

24 and 72 hours are counted as elapsed time, so a daylight-saving change cannot move them. The 14-day and one-month periods are counted on both the UTC calendar and your zone's calendar and the earlier result is shown, so the deadline here is never later than the article's under either reading.

Where to submit

Every report goes through the ENISA Single Reporting Platform: portal.cra-srp.enisa.europa.eu. One submission reaches two receivers at the same time: the CSIRT designated as coordinator and ENISA (Article 14(1)).

Which CSIRT (Article 14(7)): the one of the EU country where your is. With no main establishment in the EU, take the first that applies: the country of your authorised representative, then of your importer, then of your distributor (each time the one handling most of your products), then the country where most of your users are.

Register your EU Login and platform role now, before you need it. Only a of your company can submit, signed in with their own account with multi-factor authentication. Setting that up inside a 24-hour deadline costs time you do not have: ENISA Single Reporting Platform.

Two limits of the platform at launch. It shows no countdown for the final report of an actively exploited vulnerability, because that deadline depends on when a corrective or mitigating measure became available: for that report the date on this page is the one to keep. And it takes reports in English only at launch, so write the report text in English. (ENISA, Single Reporting Platform FAQ, questions 26 and 24, checked 2026-10-11.)

The platform's 72-hour counter is not the legal deadline. It currently shows the notification as due 48 hours after the early warning was submitted, not 72 hours after you became aware. The legal deadline is the one in Article 14(2)(b), 72 hours after you became aware, which is the one this page shows. (ENISA, Single Reporting Platform FAQ, question 26, checked 2026-10-11.)

If the platform is down, the deadlines above do not move: ENISA's FAQ gives no extra time. It says to wait until the platform is back and then submit; if something cannot wait, you may contact the CSIRT above directly, but the report must still go through the platform once it is back. Keep a note of when you tried. (ENISA, Single Reporting Platform FAQ, question 25, checked 2026-10-11.)

This tool works out the dates only, here in this browser tab. It does not send anything to ENISA or anyone else. If you press "Record the incident", the times, the case and the time zone travel with you in the sign-in link.

Relief for

Article 64(10)(a) removes the administrative fine for missing the 24-hour early-warning deadline. It is relief from the fine, not from the duty: the early warning is still owed, and the 72-hour and final-report deadlines apply in full.

Tell your users too

Article 14(8): after becoming aware, inform the users affected, and where appropriate all users, of the vulnerability or incident and of any measures they can take to reduce its impact.

Next step

Record the incident

Deadlines and report contents from Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 14(2) and 14(4) for the timings, 14(1), 14(3) and 14(7) for who receives the report, and Article 64(10) for the relief, text checked 2026-10-07. The EU Login requirement is ENISA's platform rule, not the regulation's. Legal state 2026.10.13-1.

Reading the current legal state…

What Article 14 asks for

An early warning within 24 hours of becoming aware.
A notification within 72 hours of becoming aware.
A final report: 14 days after a fix or mitigation is available for an exploited vulnerability, or one month after you submit the notification for a severe incident.

Enter when you became aware and the clock shows when each stage falls due and what it must contain. For a severe incident, add when you submitted the notification to fix the final report's date.

What happens to your data

What you type stays in this page unless you press the button to continue — then your answers go with you in the sign-in link, so the next step starts filled in.

Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.

Your deadlines

Enter when you became aware to see the three deadlines.

Where to submit