The CRA reporting clock starts on 11 September 2026.
From 11 September 2026, a manufacturer of a product with digital elements sold in the EU has to report an actively exploited vulnerability or a severe incident: an early warning within 24 hours of becoming aware of it, a notification within 72 hours, and a final report after that. The clock runs whether or not you know what is in your product.
No account is needed to scan. Nothing is uploaded.
Three clocks, one date.
Article 14 of the Cyber Resilience Act, in plain words. The regulation's own text is the reference; this is the shape of it.
Within 24 hours: the early warning
That an actively exploited vulnerability, or a severe incident with an impact on the security of the product, exists. Counted from the moment you become aware of it, not from the moment you understand it.
Within 72 hours: the notification
General information about the product, the nature of the vulnerability or the incident, and the corrective or mitigating measures taken or available to users. By now you need to know which versions ship the affected code.
Then the final report
For a vulnerability, no later than 14 days after a corrective or mitigating measure is available; for a severe incident, within one month of the notification. Reports go through the single reporting platform to the coordinating CSIRT and ENISA.
The reporting obligation applies from 11 September 2026. The rest of the regulation, from security-by-design requirements to conformity assessment and the CE marking, applies from 11 December 2027. This page is about the first date, because it arrives first and because it is the one a scanner can help with.
Why 24 hours is hard to meet.
The report itself is short. The hard part is knowing, within a day of an advisory landing, whether the named package is in a product you ship, in which versions, and whether the vulnerable code can actually be reached.
Most teams answer that today by asking around: which service pulls that library, which release went to which customer, whether the function anyone is talking about is even called. Each of those is a lookup that should take seconds and takes an afternoon, and the afternoon is the whole early-warning window. The regulation does not wait for the answer; it wants the warning first and the detail within three days.
What to have ready before the date.
Six things, each of them a file or a command you can run today, on your own machine.
An inventory of what you ship
A software bill of materials for every product and version, in the formats a regulator or a customer reads (CycloneDX and SPDX), generated from the code and its lockfiles rather than typed by hand. SBOM and VEX →
A one-second answer to "is it in my product?"
When an advisory names a package and a version, the 24-hour clock has already started. The respond command walks every lockfile and every import once and reports every place the package shows up, direct or transitive, from the files on disk. The respond command →
An exploitability statement per advisory
A VEX document (OpenVEX or CycloneDX VEX) that says, for each matched advisory, whether your code can reach the vulnerable function, citing the path behind the verdict. That is the substance of the 72-hour notification. The output formats →
One bundle for the file
The cra-bundle command staples the two SBOMs, the VEX document and a control-by-control evidence pack into one zip with a readiness one-pager. It is readiness evidence, and its own front page says it is not a conformance attestation. The cra-bundle command →
All of it on your machine
Every document is written from a scan that runs where the code already is. Nothing is uploaded, and with the air-gap switch on the vulnerability data arrives as a checksummed bundle you carry in. Air-gapped SAST →
Which of these are Free and which are Pro
The scan and every finding, with its proof and its fix, are Free on one repository at a time, and vulnerability data stays current on Free. The SBOM, the VEX and the other evidence formats, the respond command and SBOM CVE matching are part of Pro. The 14-day trial of the full product covers all of them. Pricing →
What this page is not.
Stated here rather than discovered on the day.
- Not legal advice. Whether a product is in scope, which class it falls in, and who counts as its manufacturer are questions for counsel and for the regulation's own text.
- Not the whole regulation. The CRA also covers security by design, vulnerability handling over the support period, conformity assessment and the CE marking. A scanner helps with the evidence, not with the obligations themselves.
- Not a conformance attestation. The bundle the scanner writes is readiness evidence: an inventory, an exploitability statement and a control-by-control pack, each citing what it was built from. It says so on its own front page.
- Not a substitute for knowing what you shipped to whom. The scanner tells you what is in a codebase. Which build went to which customer is a record only you hold.