CRA Article 14 reporting is live

The 24-houralarmfor connected products.

An AI product security team for device makers without one. When your firmware is exploited, Warnbell tells you within minutes whether you’re affected, drafts every report the EU Cyber Resilience Act requires, and keeps the clock.

Become a design partner Calculate your deadlines
feed checks
15 minfeed checks
exploitation feeds
6exploitation feeds
reports filed without your OK
0reports filed without your OK

Your product security team, on call 24/7, for less than one engineer-day a month.

Illustrative CRA reporting clockA dial with three rings: 24 hours for the early warning, 72 hours for the notification, and 14 days for the final report after a fix. In this example the early warning is due in 17 hours 42 minutes.2412EARLY WARNING · 24HNOTIFICATION · 72HFINAL REPORT · FIX + 14DEARLY WARNING DUE IN17:42:10CVE-2026-XXXX · ILLUSTRATIVE
  • 09:14CISA KEV lists CVE-2026-XXXX
  • 09:14AFFECTED cam-x fw 2.4
  • 09:14NOT AFFECTED plug-s fw 1.9
  • 09:16Early warning drafted · 9/9 claims sourced

Article 14 · reporting clock

Source Art. 14(2), 14(8) (source, opens in a new tab) Art. 71(2) (source, opens in a new tab)

CRA Article 14 reporting timeline for an actively exploited vulnerability: early warning within 24 hours of awareness, notification within 72 hours, final report within 14 days after a fix or mitigation is available.

  1. T+0

    Clocks start

    Awareness

    You learn a vulnerability in your product is being actively exploited.

  2. 24h

    Next deadline

    Early warning

    Via ENISA’s Single Reporting Platform, naming the EU countries where the product is sold.

  3. 72h

    Then

    Notification

    Product, nature of the exploit, corrective measures taken, and what users can do.

  4. Fix

    Days or weeks

    Fix or mitigation

    Users must be told the risk and what they can do about it.

  5. +14d

    Final

    Final report

    Severity, any known malicious actor, and the security update or other fix.

Watching every 15 minutes

  • CISA KEV
  • VulnCheck KEV
  • ENISA EUVD
  • CIRCL / GCVE
  • EPSS
  • OSV

01The problem

Every exploited bug now starts a 24-hour clock.

Since 11 September 2026, every maker selling a connected product in the EU, whether based in the EU, the UK or Asia, must report actively exploited vulnerabilities through ENISA’s Single Reporting Platform.Art. 14(1) (source, opens in a new tab) Art. 71(2) (source, opens in a new tab)

Your team covers 40 of 168 hours. The clock runs all 168.

Illustrative week

  1. Sat 02:00

    An exploited vulnerability in your firmware is published. The clock starts.

  2. Sun 02:00

    Early warning due. Nobody has seen the alert yet.

  3. Mon 09:00

    The first person reads it: 31 hours late.

What the law asks

  1. 24h

    Early warning Art. 14(2)(a) (source, opens in a new tab)

    From the moment you become aware. Name the EU countries where the product is sold.

  2. 72h

    Vulnerability notification Art. 14(2)(b) (source, opens in a new tab)

    The product, the nature of the exploit, what you’ve done and what users can do.

  3. 14d

    Final report Art. 14(2)(c) (source, opens in a new tab)

    After a fix or mitigation is available: severity, impact and the fix itself.

  4. Users

    Tell the people affected Art. 14(8) (source, opens in a new tab)

    Impacted users, and where appropriate all users, with what they can do.

Penalty

€15Mor2.5%

of worldwide annual turnover, whichever is higher. Art. 64(2) (source, opens in a new tab)

Micro & small firms: fine for missing… Art. 64(10) (source, opens in a new tab)

  • only the 24h early warning exempt
  • the 72h notification not exempt
  • the final report not exempt

How you file

Web forms. No API.

Every report is typed in by hand, by someone with an EU Login account. ENISA FAQ (source, opens in a new tab)

What’s next

The full CRA applies from 11 December 2027.

Reporting came first. SBOMs, vulnerability handling and secure updates follow.Art. 71(2) (source, opens in a new tab) Annex I (source, opens in a new tab)

—days to go

A big OEM has

  • A product security team on call 24/7
  • SBOMs and monitoring wired into every build
  • People registered and templates ready

A 5–200 person maker has

  • A firmware lead and a busy CTO
  • A shared inbox
  • Weekends

The rules are the same for both. Warnbell closes the gap.

See how

Plain-English detail in our CRA Article 14 guide.

02The AI agent

Watch the agent decide.

Pick a product. The agent reads its build, checks the exploitation evidence, reasons about whether the vulnerable code is actually there and reachable, and decides: affected, not affected, or needs a human. Then it drafts the paperwork.

Warnbell agent· ready

Replay · illustrative example

Pick a product

  1. Scroll here or press “Run the agent”.

Evidence

  1. [1]busybox 1.36.1 in the affected rangeSBOM · cam-x-fw-2.4.cdx.json
  2. [2]CONFIG_HTTPD=yBuild config · busybox .config
  3. [3]httpd listens on :80 at bootImage · /etc/init.d/S50httpd

  • Every claim cites evidenceEach sentence links to the SBOM line, build setting or feed entry behind it.
  • Says “needs a human” when unsureIt escalates rather than guesses, and the clock keeps running visibly.
  • You approve before anything is filedThe agent drafts and recommends. Your team decides.

A scripted replay of how the agent works, with a placeholder CVE and example products. Not live data.

03How it works

From exploited CVE to a ready-to-file report.

Six stations, running around the clock. Each leaves evidence, and nothing leaves the building without your sign-off.

  • in · SBOMs & builds
  • in · Exploitation feeds
  • in · Fleet telemetry

  1. STEP 01

    Knows your builds

    Ingests SBOMs or build output, including kernel config, so it knows what is actually compiled in.

    • CycloneDX
    • SPDX
    • Yocto
    • Buildroot
    • Zephyr
    • ESP-IDF

    Out →A per-version inventory of what is really in each image.

  2. STEP 02

    Watches for exploitation

    Checks known-exploited and exploitation-signal feeds every 15 minutes.

    • CISA KEV
    • VulnCheck KEV
    • ENISA EUVD
    • CIRCL / GCVE
    • EPSS
    • OSV

    Out →A short list of exploited vulnerabilities that touch something you ship.

  3. STEP 03 AI agent

    Decides if you are affected

    An AI agent checks version and reachability against your build. Affected, not affected, or needs a human, with reasons.

    • Version ranges
    • Build config
    • Reachability

    Out →A reasoned decision per product line and firmware version.

  4. STEP 04

    Watches your fleet

    Read-only connectors flag crash loops, auth-failure bursts and odd outbound connections on affected versions.

    • MQTT
    • AWS IoT Device Defender
    • Azure IoT Hub
    • Memfault

    Out →Signals from your own devices, attached to the evidence record.

  5. STEP 05 AI agent

    Drafts everything

    One evidence record produces the 24h warning, 72h notification, 14-day final report, customer advisory, CSAF and VEX.

    • 24h warning
    • 72h notification
    • Final report
    • Advisory
    • CSAF
    • VEX

    Out →Ready-to-review drafts, consistent with each other and fully referenced.

  6. STEP 06

    Runs the clocks, helps you file

    Clocks start at awareness, not portal submission. Field-by-field ENISA checklist and a hash-chained audit log.

    • Deadline clocks
    • ENISA form checklist
    • Audit log

    Out →Reports filed on time, with a record you can show a regulator.

  7. THE GATE · HUMAN IN THE LOOP

    You approve. Then it’s filed.

    Nothing reaches ENISA, a CSIRT or your customers without your sign-off. You file it, or on the Managed plan we file it on your instruction.

    • ENISA Single Reporting Platform24h, 72h and 14-day reports, field by field
    • Customer advisoryPlain language, with what users can do
    • CSAF advisory + VEXMachine-readable, for your customers’ tools

Product previews are illustrative.

Read the full pipeline, data sources and limits

04Who it is for

Device makers without a security team.

Small and mid-sized makers of connected products, shipping firmware on Linux or an RTOS, selling into the EU from the EU, the UK or Asia.

Fit profile

Team size5–200

People in the company. Big OEMs (right of the line) usually have their own PSIRT.

Sells intoThe EU
EU makerUK makerAsia makerEUmarket
Security team
None, or a firmware lead doing it part-time.
Built with
Embedded Linux / YoctoBuildrootZephyrESP-IDFFreeRTOS (via SBOM)

  • Smart plugs

  • IP cameras

  • Sensors

  • Gateways

  • Industrial controllers

  • Wearables & trackers

A good fit if you

  • Sell connected products into the EU
  • Don’t have a dedicated product security team
  • Can share an SBOM or build output

Probably not a fit if you

  • Already run a 24/7 PSIRT with its own tooling
  • Need on-device runtime protection
  • Only have closed binaries, with no SBOM

We’d rather tell you now.

Not sure? Two minutes will tell you.

Readiness check

05Pricing

Less than one engineer-day a month.

Simple monthly plans in GBP, excluding VAT. Start free with the readiness check and exploitation alerts.

£600

Drag to your own fully-loaded day rate. Each plan shows its monthly cost in engineer-days.

  • Free

    1 chip SDK, 1 product

    £0forever

    Engineer-days / month0

    free

    • CRA 24-hour readiness check
    • Exploitation alerts for one chip SDK and one product
    Take the readiness check (Free plan)

  • Starter

    1–3 product lines

    £149/ mo

    Engineer-days / month≈ 0.25

    less than one day

    • Build and SBOM ingest
    • Affected / not affected decisions, with reasons
    • All report drafts: 24h, 72h, 14-day, customer advisory
    Apply as a design partner (Starter plan)

  • Growth

    Fleet-ready

    Up to 15 product lines

    £499/ mo

    Engineer-days / month≈ 0.83

    less than one day

    • Everything in Starter, plus
    • Fleet telemetry connectors (read-only)
    • CSAF advisories and VEX
    • Jira and GitHub integration
    Apply as a design partner (Growth plan)

  • Managed

    Coming soon

    Your outsourced PSIRT

    from£1,500/ mo

    Engineer-days / month≈ 2.5

    2.5 days, with 24/7 human cover

    • Everything in Growth, plus
    • 24/7 human review of every decision
    • We file on your instruction as your Assigned Representative on ENISA’s platform
    Register interest (Managed plan)

Every paid planAll report draftsDeadline clocksHash-chained audit logENISA form checklistEU/UK hosting

Compare plans and FAQ

Prices in GBP, per month, excluding VAT. The Managed plan isn’t available yet.

Design-partner programme

Become one of five design partners.

Help shape Warnbell while it’s being built. You get the product early at £99/month, and the founder on the other end of the line. We get your honest feedback.

Apply for a place Check your readiness first

Design partner pass

Nº 01–05

£99/ month

Term
First 6 months
Includes
Growth plan, as it ships
Direct line
To the founder
In return
Honest feedback

Places open