Free tool · runs in your browser

CRA deadline calculator

Three clocks start the moment you know.

Enter when you became aware of an actively exploited vulnerability. We show your Article 14 deadlines in UTC and your local time, with a live countdown. Nothing you type is stored or sent anywhere.

Start the clock Read the Article 14 guide

Any time zone, clock changes handled
Calendar export with reminders
Nothing leaves your browser

24 hours: Early warning, from awarenessArt. 14(2)(a) (source, opens in a new tab)
72 hours: Vulnerability notification, from awarenessArt. 14(2)(b) (source, opens in a new tab)
14 days: Final report, after a fix or mitigationArt. 14(2)(c) (source, opens in a new tab)

inputsstays in your browser

1 When did you become aware?

Date and time you became aware

The moment someone in your company knew it was being actively exploited. Not when you finished investigating.

Time zone of that date and time

Defaults to your device’s time zone.

2 Optional details

Fix or mitigation available (optional)

Same time zone as above. Starts the 14-day clock for the final report.

Your reference (optional)

Labels the calendar file and the copied summary. It never leaves your browser.

This calculator needs JavaScript. The rule: early warning within 24 hours of awareness, notification within 72 hours, final report within 14 days of a fix or mitigation being available.

deadline boardwaiting for input

Your deadlines

Enter when you became aware, or press Use now. Your 24-hour, 72-hour and 14-day deadlines appear here with a live countdown.

Early warning
Vulnerability notification
Final report

Read this before you rely on it

How the clocks work

Rely on your own clock, not ENISA’s reminder.

ENISA’s Single Reporting Platform shows a 72-hour counter that runs from when you submit the early warning, not from when you became aware: it shows a due time 48 hours after that submission. Depending on when you file the early warning, that can differ from your legal deadline. ENISA says the counters are for visibility only, don’t replace your own responsibility, and will change in a later release.ENISA SRP FAQ, Q26 (source, opens in a new tab)

The deadlines

Early warning: without undue delay, and in any event within 24 hours of becoming aware. Art. 14(2)(a) (source, opens in a new tab)
Vulnerability notification: within 72 hours of becoming aware, unless already provided. Art. 14(2)(b) (source, opens in a new tab)
Final report: no later than 14 days after a corrective or mitigating measure is available. Art. 14(2)(c) (source, opens in a new tab)
You must also inform impacted users, and where appropriate all users, and tell them what they can do. Art. 14(8) (source, opens in a new tab)

How we calculate

Conservative by design. 24 and 72 hours mean exactly that much elapsed time, so a clock change never gives you an extra hour.
If you enter a local time that happened twice (clocks going back) or never happened (clocks going forward), we use the earlier reading and tell you.
For the final report, if the clocks change during the 14 days, we take the earlier of “14 × 24 hours” and “same time of day, 14 days later”.
The countdown uses your device’s clock. If that clock is wrong, the countdown is too.
This tool covers actively exploited vulnerabilities. Severe incidents have their own timeline; see the Article 14 guide.

Design-partner programme

Want the clock to start itself?

Help shape Warnbell while it’s being built. You get the product early at £99/month, and the founder on the other end of the line. We get your honest feedback.

Apply for a place Check your readiness first

Design partner pass

Nº 01–05

£99/ month

Term: First 6 months
Includes: Growth plan, as it ships
Direct line: To the founder
In return: Honest feedback

Places open

This is general information, not legal advice.