Under CRA Article 14 the clock starts the moment you become aware, not when you confirm.
If you place on-prem, desktop or embedded software on the EU market, an actively exploited dependency puts you on a 24-hour reporting deadline. See your exposure in ninety seconds — free, with nothing to install and nothing stored.
The penalty ceiling is €15m or 2.5% of global turnover (CRA Article 64 (opens the primary source in a new tab)). Filing is manual — ENISA provides no API. This tool provides detection, evidence and drafts; it does not make you compliant.
The fastest trigger produces no CVE
Exploitation in the wild, not just CVEs
Article 14 triggers on active exploitation. We surface it — including the abandoned and ownership-changed packages a CVE-only feed never flags in time.
The clock starts at awareness
A timestamped, tamper-evident record of when each signal arrived is the one fact that determines liability — and we push that signal to you, rather than waiting for you to log in.
Honest about the filing
ENISA provides no API; filing is manual. We say so plainly and give you a pre-drafted payload in the platform’s field order — not a promise of automation that doesn’t exist.
A pre-filled SRP payload — not a blank template you fill in yourself
Most CRA tooling hands you a document — a blank ENISA form, or a Word pack of the fields — and leaves the writing to you. This works the other way round. A dependency you ship enters active exploitation, and the submission payload assembles itself in the platform’s field order, from the finding, your product and release, and the manufacturer details you set once. You review it and file it.
| Aspect | Fill-in template packs | OSPulse |
|---|---|---|
| What you get | A blank Word or PDF to complete | A pre-filled payload in ENISA SRP field order |
| “When did you become aware?” | A date you assert, after the fact | A timestamped, tamper-evident record that answers it for you |
| What fills it in | You, by hand, against the clock | The real finding, your product & release, and manufacturer details set once |
| From detection | A separate, manual job | A KEV hit on your dependency starts the pack |
| Every reporting stage | A fresh blank each time | Early warning, notification and final — each assembled |
| Your job | Write the whole thing | Review it and file it |
- 01
Exploited in the wild
A dependency you ship enters CISA KEV — the “actively exploited” condition Article 14 turns on.
- 02
Awareness recorded
The moment that signal arrives is written to a timestamped, tamper-evident record — the fact liability turns on.
- 03
Clocks start
The reporting deadlines run from that recorded moment, not a button press.
- 04
Payload assembles
Each stage’s submission payload fills itself in the SRP’s field order, from the finding and your saved details.
- 05
You file it
Review and submit to the ENISA platform. Filing is manual — there is no API — and you stay in control.
The clocks are the law’s: early warning within 24 hours, notification within 72, a final report within 14 days of a corrective measure (CRA Article 14 (opens the primary source in a new tab)). The payload for each is filled for you; ENISA provides no API, so a human files it. That is the honest line — and the point: evidence and a ready payload, not a shortcut around the obligation itself.
The clock can start at 3am on a Sunday
Awareness is the trigger, so a tool that waits for you to log in is not much use. When a package you depend on enters CISA’s Known Exploited Vulnerabilities catalogue — the same “actively exploited” condition Article 14 turns on — the alert comes to you.
Within about an hour
Advisory feeds are correlated against your dependencies hourly. A KEV entry, or a new Critical or High advisory affecting the version you actually run, emails your administrators inside one detection cycle — naming the package, the advisory, the severity, and which of your repositories are affected.
On before you configure it
Alerting is on by default. A team that has never opened a settings screen is still told the first time an actively-exploited package lands in their tree. Tune the severities, or route to Slack, Teams or a webhook, whenever you want to — email always works.
Quiet enough to stay trusted
Medium and Low findings collapse into one daily digest, never a message each. Urgent events are never held back for it. And an exposure alerts once — hourly re-detection does not re-alert, so the channel stays worth reading.
This is the push the Article 14 clock otherwise lacks. It records when you were told, alongside when the signal arrived. It does not file anything for you, and it does not make you compliant.
Run CRA Article 14 readiness for your clients
White-label or co-branded. You own the client and bill directly; we provide the detection, the awareness record, and the payload underneath. No numbers on the page — the specifics are set with you.
Partner with us