From that date the Cyber Resilience Act requires manufacturers to report an actively exploited vulnerability to their CSIRT and ENISA within 24 hours, and in full within 72. But you cannot report what you never hear about. That duty therefore starts with a route people can reach you through — and we set it up and test it before you pay.
€125 one-off, excluding VAT · no subscription
A reporting route is only worth something if it works. So we test it before you pay.
A public page where researchers, customers and suppliers report a vulnerability to you. Every report lands straight in your inbox, with a countdown for the deadlines that start running.
We send a confirmation to your reporting address and call your number with a four-digit code. Only when both work can you pay. That way a trust mark never sits above a route that goes nowhere.
A mark for your website. Click it and you see the current status from our register — not a picture you coloured in yourself.
We are precise about this, because a compliance promise that is too broad will not help you in an inspection.
The precondition for the reporting duty: a findable, tested channel through which researchers and customers reach you. A report arrives with the Article 14 clock already attached, along with the details ENISA asks of you.
Filing with your CSIRT and ENISA remains your own act. ENISA provides no integration for automatic filing at launch; it goes through their platform with an EU Login account. Create that account in advance.
The substantive requirements in Annex I apply from 11 December 2027: security by design, risk assessment, technical documentation, a software bill of materials and a formal disclosure policy. What you arrange today counts towards them but does not cover them.
Takes about ten minutes. Keep your phone to hand: we call you with a four-digit code.
The email address and phone number below become your reporting route. So pick an address that is actually read and a number that is actually answered.
We sent a message to your reporting address. Click the link in it — then we both know the address is read. This page notices by itself.
Our receptionist calls you, asks who is speaking and reads out a four-digit code. Enter it here.
Your route has been tested and works. After payment your portal goes live and your trust mark arrives by email.
Because a reporting route nobody answers is not a route. By calling, asking who we are speaking to and reading out a code, we know the number is right and that someone is reachable. Our own AI receptionist makes the call; it takes half a minute.
No, and we would rather say so. On 11 September 2026 only the Article 14 reporting duty starts. We make sure you receive reports, that the deadlines are visible and that the requested details are ready; filing is your own step. The broader Annex I requirements follow on 11 December 2027.
No. €125 once, excluding VAT. Your portal and trust mark keep working. You can grow into more later, but you do not have to.
The free and open-source exemption does not cover software offered in the course of a commercial activity — a paid edition or paid support, for instance. If you are unsure, get in touch and we will look at it with you, no obligation.