./cra/reporting_clock --start

CRA reporting clock

Work out your Cyber Resilience Act reporting deadlines and see exactly which fields ENISA's Single Reporting Platform asks for at each stage.

What the form asks for

Required fields first. Carried-over fields are copied from the previous stage and can be updated. Field names are shown as they appear in the platform.

• Notification type (Vulnerability/Incident)requiredIndicates whether the notification concerns an actively exploited vulnerability (AEV) or a severe incident (SI) having an impact on the security of a product with digital elements.
• Titlerequiredmax 255 charsShort human-readable name for the notification.
• Summaryrequiredmax 4000 charsConcise overview of the facts, affected product, and issue being notified.
• Manufacturer namerequiredName of the natural or legal person who develops or manufactures the product with digital elements or has the product with digital elements designed, developed or manufactured, and markets it under its name or trademark, whether for payment, monetisation or free of charge.
• Member States where product available (Concerned CSIRT)requiredMember States in which territory the manufacturer is aware that the affected product has been made available; used to determine concerned CSIRTs.
• Product Namerequiredmax 255 charsName that identifies the affected product with digital elements.
• Product Versionrequiredmax 255 charsVersion, release, build, model, or other revision information required to identify the affected product instance.
• Date and time when you become aware of the Actively Exploited VulnerabilityrequiredDate and time when the manufacturer or another relevant party first detected the vulnerability.
• Product Type (Default/Important Product with Digital Elements/Critical Product with Digital Elements)optionalRegulatory category indicating whether the product is default, important, or critical under the CRA classification framework.
• Product classoptionalFor an Important Product with Digital Elements, the applicable Class I or Class II category used for conformity-assessment treatment.
• Product categoryoptionalThe applicable CRA product category, normally selected from the relevant category list, as mentioned in the CRA Annexes III or IV.
• End of support indicatoroptionalIndicates whether the product with digital elements has reached the end of the support period.
• Component nameoptionalmax 255 charsName of the software or hardware component in which the vulnerability or incident is located or observed.
• Mitigating measure expected shortlyoptionalIndicates whether an effective risk-mitigation measure, such as a security update or user guidance, is expected to become available.
• User Action able to reduce impactoptionalmax 4000 charsAction that product users can take to prevent, reduce, or contain the impact of the actively exploited vulnerability or severe incident.
• Considered sensitivity of informationoptionalmax 255 charsManufacturer's assessment of how sensitive the notified information is to inform secure handling and dissemination decisions.
• Corrective or mitigating measures takenoptionalmax 2000 charsActions already implemented by the manufacturer or other responsible party to correct the issue or reduce its risk or impact.
• Corrective or mitigating measures that users can takeoptionalmax 4000 charsInstructions or actions users can apply to reduce exposure or impact, including workarounds, configuration changes, patches, or isolation measures.
• CVE IDoptionalmax 255 charsCVE Identifier (CVE ID) assigned to the publicly disclosed vulnerability under the Common Vulnerabilities and Exposures (CVE) Program.
• EUVD IDoptionalmax 255 charsIdentifier of the vulnerability record in the European Vulnerability Database (EUVD).
• General informationoptionalmax 4000 charsHigh-level description of the vulnerability and, where known, how exploitation works, without requiring the full final technical analysis.
• Date when corrective or mitigating measure has been availableoptionalDate and time when the mitigating measure has been available.
• Details about the security update/corrective measure availableoptionalmax 2000 charsInformation on available corrective measures and security updates.
• Full description of the Severity of the vulnerabilityoptionalmax 4000 charsComplete description of the actively exploited vulnerability, including at least its severity.
• Full description of the Impact of the vulnerabilityoptionalmax 4000 charsComplete description of the actively exploited vulnerability, including at least its impact.
• Date and time when the Actively Exploited Vulnerability occurred (UTC time)optionalKnown or estimated date and time when the actively exploited vulnerability occured.
• Malicious actor that has exploited/is exploiting the vulnerabilityoptionalmax 100 charsAvailable information about the actor that exploited or is exploiting the vulnerability, without requiring attribution where information is unavailable.
• Please provide further informationoptionalmax 800 charsDescription of anything that should be helpful for CSIRT Designated as Coordinator (CDaC)taking their decision.

Fields from ENISA CRA SRP Glossary v1.3 (25 September 2026). Check the platform itself if anything looks different.

Do these before you need them