Free tool
CRA deadline calculator
Enter the moment your organisation became aware. The calculator applies the Article 14 baseline rules — the same engine Vellaci uses in production, including calendar-month arithmetic and timezone handling. Illustrative only; confirm with your advisers.
Direct answer · regulation
Which CRA requirements apply now?
CRA Article 14 reporting obligations apply from 11 September 2026. The CRA’s general application date is 11 December 2027.
- Applicability
- Article 14 reporting is currently applicable. The CRA’s general application date is later; this calculator computes Article 14 timing only and does not decide whether a specific event is reportable.
- Operational workflow
- Supply an awareness time after your organisation has established that operational trigger. The calculator computes deadlines only; a manufacturer or assigned reviewer makes and documents the applicability decision.
Starts the 14-day final report timer.
Deadlines (Europe/Brussels)
Enter an awareness time to compute deadlines.
How it works
Four inputs, three deadlines.
- Step 1
Choose the case type
Actively exploited vulnerability or severe incident. They share the 24-hour and 72-hour steps but have different final-report triggers.
- Step 2
Enter the awareness time and timezone
The moment a named person in your organisation confirmed awareness — not when the ticket was opened. Pick the organisation's timezone so daylight-saving changes are handled.
- Step 3
For vulnerabilities, enter when the fix became available
The final report is due 14 days after a corrective or mitigating measure is available. Leave it empty if no fix exists yet; no final-report timer runs until then.
- Step 4
Read the deadlines
Early warning (24 h), notification (72 h) and final report (14 days after the fix, or one calendar month after the notification for incidents) are shown in your timezone and in UTC.
- Is the calculator the same engine as the product?
- Yes. It loads the same versioned rule set Vellaci applies in production, including calendar-month arithmetic (a notification on 31 January produces a final report due 28 or 29 February, not 2 March) and IANA timezone handling across daylight-saving transitions.
- Does 'within 24 hours' mean business hours?
- No. Article 14 counts elapsed time from awareness. An awareness at 17:00 on a Friday means an early warning by 17:00 on Saturday. That is why the runbook should name a deputy for the assigned representative.
- Can the deadline be extended?
- The regulation does not provide for extensions of the 24-hour and 72-hour steps. If information is incomplete, submit what you have and update it; the early warning is designed to be minimal.
Read next
- Guide
CRA reporting timeline: 24 hours, 72 hours and the final report
How the Article 14 deadlines are computed, where the final-report trigger sits for vulnerabilities versus incidents, how calendar months and daylight-saving time behave, and three worked examples.
- Guide
CRA Article 14 reporting obligations: a practical guide for manufacturers
What must be reported under Article 14 of the Cyber Resilience Act, by whom, to whom and when — the 24-hour early warning, 72-hour notification and final report — and how to operationalise it now that the obligation is in force (since 11 September 2026).
- Guide
Incident or vulnerability? How the CRA treats the two reportable events
Actively exploited vulnerabilities and severe incidents share the 24-hour and 72-hour steps but differ in definition, notification content and final-report trigger. How to classify an event, when one becomes the other, and what to record.
- Docs
Reporting cases and deadlines
24h early warning, 72h notification, final report.
Run these clocks automatically.
Vellaci opens a reporting case from a confirmed awareness time and alerts the right people at the right thresholds.