CRA REPORTING · ART. 14 REGULATION (EU) 2024/2847
Since 11 September 2026 the CRA requires manufacturers to report actively exploited vulnerabilities via ENISA within 24 hours, even for products already sold. You get 30 days of CVE watch on your SBOM free; we make you reporting-ready in 10 days from €3,900 excl. VAT.
The clock starts when you know. The early warning is due 24 hours after you become aware of exploitation. Without an SBOM you often never learn that an affected library is in your product.
ReferencesT-Systems · Olingo Medical · Lumii · Rowan Legal
Leave your number, I'll call you
Krystof Olik · founder and CEO
Same working day (CET), otherwise the next working morning.
CRA updates by email. Once a month: what changed and what it means for your product.
The CVE watch runs on our own tool and framework for CRA testing, not as a one-off audit.
CRA vulnerability reporting (Art. 14 of Regulation (EU) 2024/2847) obliges manufacturers, since 11 September 2026, to report actively exploited vulnerabilities in their product and severe incidents affecting its security via the ENISA platform (Art. 14(1) and (3)).
When, after an initial assessment, you have a reasonable degree of certainty that a vulnerability in your product is being exploited or that a severe incident occurred (Commission guidance, para 213).
Via ENISA’s Single Reporting Platform, simultaneously to the CSIRT designated as coordinator in the Member State of your main establishment and to ENISA (Art. 14(7)).
You can only report what you notice, and an SBOM lists the components and versions in each shipped product.
OFFER
The free watch runs on your SBOM, with no code access, and shows at once which components have vulnerabilities and which of them matter.
Step 1 · Start here
For 30 days you see every new vulnerability in one product and whether it may become reportable.
Free
What you get
Step 2
You recognize reportable cases and can notify within 24 hours.
from €3,900excl. VAT, one-off
What you get
Step 3
New vulnerabilities are triaged continuously and reports are prepared.
from €390 per monthexcl. VAT
What you get
GUARANTEE
If your reporting process is not operational 10 days after repository access, we keep working at no extra cost until it is. Applies to "CRA reporting-ready in 10 days".
Your SBOM is enough · ends automatically, no subscription
Leave your number, I'll call you
Krystof Olik · founder and CEO
Same working day (CET), otherwise the next working morning.
PROCESS
Products, SBOM, who handles security reports today. No code access.
On your SBOM, daily matching, free for 30 days.
Code review, SBOM in CI, runbook, templates, accounts, exercise.
Triage of every match, help with every report.
REFERENCES
We built the CRA compliance platform for T-Systems: it matches every product’s SBOM daily against new vulnerabilities and every six hours against exploited lists. An AI agent triages each new match and records the verdict as OpenVEX; a shipped, actively exploited component raises the Art. 14 steps with their 24-hour, 72-hour and 14-day deadlines.
AI for clinical documentation: more than 10 hospitals and clinics use it; in two university hospitals it runs entirely inside the hospital network. We prepared it for the CRA.
olingomedical.comOur partner law firm for NIS2 and CRA: we do the technical work and prepare processes and documentation, its lawyers validate them and prepare the contracts. We also built AI for the firm that runs on its own servers, with no external APIs.
rowan.legalCONTACT
After a short call you send us the SBOM of one product and we switch on 30 days of CVE watch for free, with no code access. Then it ends on its own: no subscription, nothing to cancel.
Leave your number, I'll call you
Krystof Olik · founder and CEO
Same working day (CET), otherwise the next working morning.
FAQ
Yes. Art. 69(3) extends it to all in-scope products placed on the market before 11 December 2027, and per the Commission guidance it continues after the support period ends.
The free watch runs on an SBOM you send us; we need no code access. If you have none, the 10-day package builds it from your repositories and hooks its generation into your release process.
You, as the manufacturer (Art. 14(1)). We set up the SBOM, monitoring, runbook and templates and help fill in every report. Legal review stays with your counsel, or lawyers at our partner firm Rowan Legal can do it.
Manufacturers that ship open source in their products report for those products now. Open-source stewards report from 11 December 2027, to the extent they are involved in development (Art. 24(3) and Art. 71(2)).
Infringements of Art. 14 can be fined up to €15m or 2.5% of worldwide annual turnover, whichever is higher (Art. 64(2)).
The first 30 days of CVE watch are free, on your SBOM and without code access. The 10-day package starts at €3,900 excl. VAT, ongoing CVE watch at €390 per month.
"CRA reporting-ready in 10 days" (from €3,900) covers only the reporting that already applies: SBOM in CI, CVE watch, runbook, templates, EU Login accounts and an exercise. "CRA readiness in 6 weeks" (from €7,900) prepares the whole product for 11 December 2027 and includes the ENISA reporting runbook too. In operation, both "CVE watch in operation" (from €390 a month) and "CRA in operation" (from €590 a month) match daily against new CVEs, triage matches as OpenVEX and help with reports; "CRA in operation" also generates the SBOM on every release and updates the risk assessment and documentation. All prices excl. VAT.
Newsletter
The CRA keeps being filled in: Commission guidance, the ENISA platform, harmonised standards. Once a month, and whenever something important changes, we send a short overview of what changed and what it means for your product.
MORE SERVICES
