Skip to content
CRA Reporting Desk

CRA Article 14 deadline calculator

Enter when you became aware of an actively exploited vulnerability or a severe incident affecting your product. You get the 24-hour early warning, 72-hour notification and final report dates under the EU Cyber Resilience Act, in your time zone and in UTC. No sign-up.

Loading the calculator…

How the dates are calculated

  • Early warning: 24 hours after you became aware (Article 14(2)(a) and 14(4)(a)).
  • Notification: 72 hours after you became aware (Article 14(2)(b) and 14(4)(b)).
  • Final report, actively exploited vulnerability: 14 days after a corrective or mitigating measure is available (Article 14(2)(c)). The calculator keeps the same local time of day, including across a clock change.
  • Final report, severe incident: one month after the 72-hour notification (Article 14(4)(c)).

The 24-hour and 72-hour clocks run through nights, weekends and public holidays. For the final report we show the plain calendar date; treat it as your target and do not plan on any extension. Article 14 deadlines explained.

Worked examples

Vulnerability. You become aware on Tuesday 6 October 2026 at 14:00. The early warning is due Wednesday 7 October at 14:00 and the notification Friday 9 October at 14:00. A patch ships Monday 12 October at 10:00, so the final report is due Monday 26 October at 10:00.

Severe incident. Same moment of awareness. You send the 72-hour notification early, on Thursday 8 October at 16:00, so the final report is due Sunday 8 November at 16:00. Had you sent it at the deadline, it would have been Monday 9 November at 14:00.

The dates are the easy part

The hard part is having the case file ready at each step: what you knew and when, which product versions are affected, what you have told users, and evidence for why the case is reportable. The free CRA Reporting Desk keeps the case, counts down each deadline, marks what you have sent and drafts the 24-hour, 72-hour and final reports from what you enter. Use "Track this case in the free desk" above to carry these dates over.

Run the free CRA Reporting DeskBook a 20-minute demo

Questions people ask

How do I calculate the CRA Article 14 deadlines?
Start from the moment the manufacturer became aware. The early warning is due 24 hours later and the notification 72 hours later. For an actively exploited vulnerability, the final report is due 14 days after a corrective or mitigating measure is available. For a severe incident, it is due one month after the 72-hour notification.
Do weekends and public holidays pause the 24-hour and 72-hour clocks?
No. The 24-hour and 72-hour periods run in hours, so nights, weekends and public holidays count. Plan cover for the whole period.
Why is the severe incident final report shown as 'at the latest'?
Its deadline runs from when you actually send the 72-hour notification. Until you enter that date, the calculator assumes you send it at the 72-hour deadline, which gives the latest possible final report date. Sending the notification earlier brings the final report forward.
What if there is no fix yet for the vulnerability?
The final report for an actively exploited vulnerability is due 14 days after a corrective or mitigating measure is available. Until one exists, that date cannot be set. The 24-hour and 72-hour reports are still due on time.
Which time zone does the calculator use?
Your browser's time zone. Each date is also shown in UTC so teams in different countries can agree on the same deadline.

Workflow support, not legal advice. Whether a vulnerability or incident must be reported, when you became aware, and what you submit are your decisions. You file through ENISA's Single Reporting Platform. Source: Regulation (EU) 2024/2847, Article 14 (EUR-Lex) and the European Commission's summary of CRA reporting obligations.