Free tool · 2 minutes · nothing stored

Could you file an early warning within 24 hours?

8 yes/no questions about what decides whether you meet the CRA’s 24-hour deadline. You get a score and a short list of gaps. Your answers stay in your browser; we never see them.

Start the check Deadline calculator
  • 8 questions
  • About 2 minutes
  • Anonymous, nothing stored

What we check

  1. SBOM per version
  2. Exploit monitoring
  3. ENISA platform access
  4. EU markets known
  5. Disclosure policy
  6. Field updates
  7. Report templates
  8. Weekend cover
  1. SBOM per version

    Do you have an SBOM for every firmware version you ship?

    A software bill of materials (CycloneDX or SPDX) per version, not just per product.

  2. Exploit monitoring

    Does a named person check known-exploited vulnerability lists at least daily?

    For example CISA KEV or ENISA’s EU Vulnerability Database, matched against your components.

  3. ENISA platform access

    Is someone registered on ENISA’s Single Reporting Platform with an EU Login account?

    EU Login with multi-factor authentication, set up before you need it.

  4. EU markets known

    Do you know which EU countries each product is sold in?

    Including through distributors and online marketplaces.

  5. Disclosure policy

    Do you publish a vulnerability disclosure policy?

    A public page saying how researchers can report vulnerabilities to you, with a contact address.

  6. Field updates

    Can you push a security update to devices already in the field?

    Over the air, or through an app or another channel your customers actually use.

  7. Report templates

    Do you have templates for the early warning, notification and final report?

    Pre-filled with your company details, products and contacts.

  8. Weekend cover

    Is someone on call at weekends and holidays?

    Someone with the authority to start the clock and submit an early warning.

Your progress

0/8answered
  • In place0
  • Gap0
  • Not sure0

Unanswered questions count as gaps. Nothing is stored or sent.

0 of 8 answered · 0 yes

This is general information, not legal advice.