Article 14 applies from 11 September 2026

Your 24-hour clock under the Cyber Resilience Act.

The obligation is running. Under the Cyber Resilience Act, an actively exploited vulnerability in something you ship has to be reported to your national CSIRT and ENISA within 24 hours, including at two in the morning on a Sunday. Declara watches your components, starts the clocks the moment you decide, and drafts all three filings.Art. 14⁠(2)⁠⁠(a)⁠

It applies to every manufacturer placing software or connected hardware on the EU market, wherever the company is based.Art. 2⁠(1)⁠

Start a 14-day trialCheck your SBOM free

No card. The trial does not start until you upload an SBOM, so you do not burn a week of it working out what to upload.

Maximum fine
€15Mor 2.5% of turnover, whichever is higherArt. 64
Applies to
EU marketwherever the company is basedArt. 2⁠(1)⁠
First filing due
24hfrom becoming awareArt. 14⁠(2)⁠⁠(a)⁠
The reporting duty has applied forArt. 71(2)
24hours:00minutes:00seconds
  1. Early warningArt. 14⁠(2)⁠⁠(a)⁠24h
  2. NotificationArt. 14⁠(2)⁠⁠(b)⁠72h
  3. Final reportArt. 14⁠(2)⁠⁠(c)⁠14d

Counting from the day the reporting obligations started applying. The twenty-four hours above start when you become aware of active exploitation — not when a component appears on a list, and not only on a working day.

See it work

Alert, assessment, filing

Not a video and not screenshots. The questions below come from the product, the deadlines are computed by the same arithmetic, and the filing is generated by the same adapter. Click through it.

A worked example, running the real product

CVE-2021-44228

Actively exploited

Remote code execution in Apache Log4j 2

Assess now
Severity
10.0CVSS, out of 10
Exploitation probability
94.4%EPSS, next 30 days
Listed as exploited
2021-12-10
CISA catalogue

What you ship that contains it

  • org.apache.logging.log4j/log4j-core@2.14.1Acme Endpoint Agent 4.2.1
  • org.apache.logging.log4j/log4j-core@2.14.1Acme Endpoint Agent 4.1.8

No clock has started. A component appearing in an exploitation catalogue means someone, somewhere, is exploiting it. Whether your product is affected is a separate question, and it is the one Article 14 turns on.Art. 14⁠(1)⁠

Your file
Never storedThe free check parses it in memory and discards it.
Your data
EU, FrankfurtHosted in the EU. We state the limits of that on the security page. Read it
What it costs
On the pagePublic prices, no sales call, no contact-sales tier. Read it

Find out in thirty seconds

Is anything you already ship being exploited?

Drop in the SBOM you already generate. We match it against the CISA catalogue of vulnerabilities being exploited in the wild and show you exactly what comes back.

Drop an SBOM, or choose a file

Format
CycloneDX SPDX
Encoding
JSON · XML tag-value
Size
up to 4 MB

Nothing is storedParsed in memory and discarded. No account, and no record of what you ship — we keep the count of how many components came back, never their names.

I do not have an SBOM

A software bill of materials is the list of every open-source component inside something you ship, with its version, written in a format other tools can read. Syft is a free tool from Anchore that builds one for you by reading a container image, a source directory or a binary. It takes a minute, and you only need it once per release.

# 1. Install it, on macOS
brew install syft

# ...or anywhere else
curl -sSfL https://get.anchore.io/syft | sh -s -- -b /usr/local/bin

# 2. Point it at what you ship
syft acme/agent:latest -o cyclonedx-json > sbom.json

# ...or at a source directory
syft dir:. -o cyclonedx-json > sbom.json

Replace acme/agent:latest with your own image. The redirect writes the bill of materials to sbom.json, and syft keeps its progress on stderr, so the file stays valid JSON. Then drop that file above. The full guide covers formats and running it per release.

How it works

From the SBOM you already build to a filing you can send

  1. 01

    Upload your SBOM

    The CycloneDX or SPDX file your build already produces, one per version you still support. Push it from CI if you would rather not think about it again.

  2. 02

    We watch it

    Every hour your components are matched against the catalogue of vulnerabilities being actively exploited, and nightly against the advisory feeds that supply version ranges and scores. If something you ship turns up, you get one alert and four questions, not a wall of CVEs.

  3. 03

    If you must report, the clocks run

    Decide it is reportable and the 24-hour, 72-hour and final deadlines start. Each filing is drafted from your own data, addressed to your national CSIRT, with an audit trail of every decision — including the decision not to file.

The obligation

Three filings, and the first one is the one people miss

All three run from the moment you become aware, except the last, which is where most of the confusion lives.

  1. 0124h

    Early warningArt. 14⁠(2)⁠⁠(a)⁠

    Tell the authority something is happening. Deliberately short: the member states where you know the product is available. Twenty-four hours includes the night and the weekend.

  2. 0272h

    NotificationArt. 14⁠(2)⁠⁠(b)⁠

    What the vulnerability is, an initial assessment of severity and impact, what you have done about it, and what your users can do themselves.

  3. 0314d

    Final reportArt. 14⁠(2)⁠⁠(c)⁠

    Full description and the fix. This clock starts when a corrective measure becomes available, not when you became aware, which is the detail most often got wrong.

The 27 national authorities you may have to file to

What separates this from a scanner

A component on a watchlist is not a reportable event

  1. 01Is the vulnerable component actually in the shipped product?
  2. 02Is the vulnerable code path reachable in it?
  3. 03Is there evidence of exploitation against our product or users?
  4. 04Is a fix or mitigation already shipped?

Answered before any clock starts

Article 14 is triggered by exploitation of your product, not by one of your dependencies appearing in a catalogue. Tools that conflate the two either bury you in false alarms or push you into filings you never owed.

So when something you ship turns up in the CISA catalogue, Declara opens an assessment, not a report. You answer four questions about reachability and evidence. The decision is logged either way, including the decision not to file.

If the answer is that you must report, the clocks start from the moment you decided, and the filings are drafted for you.

See the evidence pack this produces →

Read the obligation in plain language →

No contact-sales tier, because the answer to “what does it cost” should not be a meeting.

14 days free, and the trial does not start until you upload an SBOM. Every plan runs the same three clocks and produces the same filings; the tiers differ in how much you watch, not in whether you can report.

Start a 14-day trialCompare the plans
Starterper product
€59/mo
Growthup to 5 products
€199/mo
Partnerup to 10 client workspaces
€499/mo

Questions

The five things people ask before they try this

Does this actually apply to us? We are not a security company.
If you place software or connected hardware on the EU market it applies, whatever your company does, and whether or not you are based in the EU. The reporting duty has applied since 11 September 2026; the rest of the Act follows on 11 December 2027. The scope check answers it in five questions with no sign-up.
Cannot our lawyer just handle this?
A lawyer should write your disclosure policy, and you should have one. No lawyer can tell you at two in the morning on a Sunday that a component in version 4.1.8 is being exploited, and that is the part with a 24-hour deadline attached. Bring the lawyer for the policy and use this for the clock.
You want our SBOM. That is a map of everything exploitable in our product.
The free check parses your file in memory and discards it. No account, no storage, no record of what you ship. If you become a customer your inventory is hosted in the EU, in Frankfurt, and our providers are US companies, so this is EU hosting rather than EU legal control. Anyone whose procurement asks deserves that answer.
What if we report something we did not have to?
That is the failure this is built to avoid. A component appearing in an exploitation catalogue is not a reportable event: Article 14 turns on exploitation of your product. You answer four questions about reachability and evidence before any clock starts, and the decision is logged either way, including the decision not to file.
What does it cost, and what happens if we stop paying?
Prices are public and there is no sales call. If you downgrade, products over the limit are paused rather than deleted, so your inventory and case history stay intact. A compliance record you cannot get back is worse than a failed upsell.

What this is not

Not a scanner
Trivy and syft are free and better at that. Bring the SBOM they produce.
Not a policy binder
A lawyer will sell you one, and should. This runs the clock instead.
Not compliance
You are the manufacturer and that stays yours. This produces the evidence and the drafts a non-lawyer can file on time.
Start a 14-day trialCheck an SBOM against the exploited list

Still not sure the CRA applies to you? Five questions, no sign-up.