CRA reporting deadline calculator

Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products with digital elements (Art. 14 Cyber Resilience Act). The calculator shows you the deadlines with date and time. Free, no sign-up. Your details are never stored with anything that identifies you.

1. What do you have to report?

Actively exploited vulnerability
A vulnerability in your product is reliably known to be exploited already (Art. 14(1) CRA). Severe incident
An incident affects the security of your product, e.g. the protection of important data or through injected malicious code (Art. 14(3) and (5) CRA).

2. When did you become aware of it?

Date and time. The 24-hour and 72-hour deadlines run from this point.

3. Time zone

Matters for the display and for month deadlines. The hour deadlines stay the same.

4. Optional: calculate the deadline for the final report

For vulnerabilities: correction or mitigation available since

The final report is due no later than 14 days after that (Art. 14(2)(c) CRA).

For incidents: notification submitted on

The final report is due within one month after that (Art. 14(4)(c) CRA).

Do not count my answers in the anonymous statistics What is counted

Frequently asked questions about CRA reporting deadlines

Does the reporting obligation also apply to products already on the market?

Yes. Since 11 September 2026, the reporting obligation under Art. 14 also applies to products placed on the market before 11 December 2027 (Art. 69(3) CRA).

What does “without undue delay” mean?

The deadlines are maximum periods. Report as early as possible; 24 and 72 hours are the latest points in time.

Why does the calculator behave differently across the clock change?

A 24-hour deadline ends after 24 real hours. If the clock changes in between, the clock shows one hour earlier or later at the end than at the start.

Are my inputs stored?

Not with anything that identifies you. The evaluation happens in working memory. We only count anonymously which answer options and results are chosen, never who chose them; you can opt out of this in the form. Details in the privacy policy.

Do I also have to report under NIS2 or the GDPR?

Possibly, with their own deadlines and to other bodies. The free applicability check shows whether NIS2 applies to your company.

Try Complass with your own data

Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.

Try for free Request a demo