CRA reporting duties apply since 11 September 2026
Know when the CRA's 24-hour clock may have started.
Vulnio checks your SBOM or lock file against known vulnerabilities and against the lists of actively exploited ones (CISA KEV, ENISA EUVD), watches it every day, and gives you the Art. 14 deadlines and copy-ready drafts for ENISA's reporting platform. Built for small software and connected-device makers.
Free, no account, no card. We keep component names and versions only, never your file, and delete one-off scans after 30 days.
From the moment you become aware
- 24 hours Early warningArt. 14(2)(a), 14(4)(a)
- 72 hours Vulnerability or incident notificationArt. 14(2)(b), 14(4)(b)
- 14 days / 1 month Final report: 14 days after a fix is available (vulnerability), one month after the notification (severe incident)Art. 14(2)(c), 14(4)(c)
Today Vulnio knows 1,796 vulnerabilities listed as actively exploited by CISA KEV and ENISA EUVD.
What the regulation says
Two dates, and one of them has passed
11 Sep 2026
Reporting applies
Manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform (Art. 14, Art. 71(2)). This also covers products placed on the market before 11 December 2027 (Art. 69(3)).
11 Dec 2027
Everything else applies
Essential cybersecurity requirements, vulnerability handling (including an SBOM), technical documentation, conformity assessment and CE marking (Art. 13, Annex I, Art. 71(2)).
Small companies are not exempt from reporting. Micro and small enterprises are only spared fines for missing the 24-hour early warning (Art. 64(10), as corrected on 2 July 2025).
What Vulnio does
From a lock file to a report draft
Scope check
Eight questions, an answer with article references: in scope, out of scope, or unclear (then ask a lawyer).
One-off scan
CycloneDX, SPDX, package-lock, composer.lock, requirements/poetry, go.sum, Cargo.lock, pom.xml, gradle.lockfile. Exploited matches first.
Daily monitoring
Your products are re-scanned every day. A new actively exploited match sends you an e-mail the same morning.
Incident log and deadlines
Enter when you became aware; see 24 h, 72 h and final report deadlines counted as the regulation counts them.
Report drafts
Early warning, notification and final report laid out in the order of the platform's fields, plus a user notice in English and German.
security.txt and policy
A hosted vulnerability disclosure policy and an RFC 9116 security.txt, and a PDF evidence record per product.
What Vulnio does not do
Plainly
- It does not decide whether you must report. A KEV or EUVD listing means the vulnerability is exploited somewhere, not necessarily in your product.
- It does not submit anything to ENISA. The platform has no API (ENISA FAQ); you paste the drafts and submit them yourself.
- It is not legal advice and does not replace a lawyer where the scope is unclear.
- Not in this version: technical documentation and EU declaration of conformity templates, a GitHub app.
Pricing
Free to check, €29 a month to keep watching
The scope check and the one-off scan stay free. Monitoring, alerts, the incident log and the drafts are paid.
Free
€0
- CRA scope check with article references
- One-off scan of an SBOM or lock file
- Exploited matches (CISA KEV, ENISA EUVD) first
Prices exclude VAT. VAT is added where it applies (EU customers without a VAT number); with a valid EU VAT number reverse charge applies.
Start with your lock file
It takes about a minute and needs no account.