Article 14 has been in force since 11 September 2026
On 11 September 2026 the EU Cyber Resilience Act's reporting obligations became enforceable. If a vulnerability in a product you've placed on the EU market is being actively exploited, you owe an early warning to your national CSIRT and ENISA within 24 hours of becoming aware.
Most of the CRA doesn't bite until December 2027. This part is live now — and it applies to products you shipped years ago that are still on the market.
Legal basis: Regulation (EU) 2024/2847, Article 14. Penalties for non-compliance can reach €15 million or 2.5% of worldwide annual turnover. Products already on the market before the deadline are in scope (Article 69(3)).
Start with the free part. cra-watch reads your lockfiles, resolves them
against OSV.dev, and intersects the result with the CISA Known Exploited Vulnerabilities
catalogue — the closest public register of what is genuinely being exploited in the wild.
Not "here are 400 CVEs, good luck." One question: is any of it on the known-exploited list today?
$ cra-watch scan Advisories 13 component(s) carry at least one known advisory KEV feed 1709 entries, catalogue 2026.09.11 NO KEV MATCHES. Nothing in your dependency graph appears on the CISA Known Exploited Vulnerabilities catalogue. On this evidence there is no Article 14 24-hour reporting trigger from a listed component today.
Or the other answer:
2 KEV MATCH(ES) - MANUAL DECISION REQUIRED NOW CVE-2021-44228 (GHSA-jfh8-c2jp-5v3q) component org.apache.logging.log4j:log4j-core 2.14.1 [Maven] known as Apache Log4j2 Remote Code Execution Vulnerability KEV listed 2021-12-10 ransomware use: Known If you confirm exploitation in your product, the clock is: Early warning within 24h 2026-09-15 08:40:10 UTC Notification within 72h 2026-09-17 08:40:10 UTC Final report within 14d 2026-09-28 08:40:10 UTC
Free, MIT licensed, standard library only, no account, no telemetry. 12 lockfile formats plus CycloneDX and SPDX SBOMs. Exit codes designed to be a CI gate.
Run it on a schedule, not just on push. The KEV catalogue gains entries continuously — a repo that was clean yesterday can be a reporting question today without a line of your code changing.
The tool narrows a thousand CVEs to a shortlist. It cannot tell you whether to file — because Article 14's actual test is whether the vulnerability is being exploited in your product, and that's a human judgement about reachability, evidence, and timing.
That judgement is where organisations come apart under a 24-hour clock. Who is accountable for pressing send? What does an early warning say when you still know almost nothing? What defends a decision not to report, eight months later, to a market surveillance authority?
The clock starts when you have a reasonable degree of certainty after an initial assessment — not when a rumour arrives, and not when you finish the investigation.
The kit is the process around the decision: written in advance, so the 24 hours are spent deciding rather than inventing a procedure.
Secure checkout by PayPal — card or PayPal balance, no account required. Download link appears here immediately after payment and is emailed to you.
The single licence above covers one organisation. This one covers you deploying the kit into client engagements — consultancies, fractional CISOs, MSPs, and groups running several legal entities.
You still may not resell the pack itself as a product or publish it publicly. It's a licence to use it in your work, not to republish it.
Same instant download. Same 14-day refund.
| File | What it does |
|---|---|
| 00-START-HERE | The first hour. A ten-line quick start for someone who just got the call. |
| 01-DECISION-TREE | Report / don't report, as an ASCII tree and a numbered checklist. |
| 02-TIMELINE-AND-CLOCKS | The cascade, worked in UTC, including what to file when you still know nothing. |
| 03-REPORT-TEMPLATES | Early warning, 72-hour, final. Fill in the blanks. |
| 04-EVIDENCE-LOG | Contemporaneous record template, with a filled example. |
| 05-ROLES-AND-DRY-RUN | Who does what, plus a 30-minute tabletop you can run this week. |
Delivered as Markdown (editable, diffable, drop it in your repo next to your incident runbooks) plus a single combined PDF for people who want to print it and put it on a wall.
You manufacture a product with digital elements — software, hardware, a connected device, a component sold separately — and it's available on the EU market. Directly, or through an importer, distributor, or authorised representative. Being based outside the EU doesn't remove the obligation.
You're probably a team of 5 to 200 without a dedicated regulatory function, where the person who'd have to file is also the person shipping features. The kit exists so that person has a procedure instead of an afternoon of reading a regulation.
If you have in-house regulatory counsel who've already drafted your Article 14 procedure, you don't need this. If you're looking for a compliance certificate, nothing here is one, and anyone selling you one is selling you something that doesn't exist.
A copy of these links has been emailed to you. Bookmark this page — the links stay live. Questions: dev@toledotechnologies.com
Yes. MIT licensed, on GitHub, no account, no telemetry, no upsell inside the tool. It's genuinely useful on its own and I'd rather it were widely used than gated.
No, and the tool says so explicitly. KEV evidences exploitation somewhere in the world. Article 14 asks about exploitation in your product. If the vulnerable code path is unreachable in your build, the answer may be no. The kit's decision tree walks that distinction, and the evidence log is how you record the reasoning.
No. It's a US government catalogue — it lags, and it isn't exhaustive. Your own telemetry or a customer's incident report can start the clock before CISA lists anything. KEV is a strong, free, public signal. It isn't the boundary of the obligation.
It's a digital download, so it's yours the moment you buy it. If it's not what you expected, email within 14 days and you get your money back, no argument. Refunds go back through PayPal to the original payment method.
The purchase is the current version, and you get any revision published in the 12 months after you buy at no extra cost — emailed to the address you paid from. To be straight with you: that's a document-revision commitment, not a support contract or a subscription. There's nothing to cancel.
Toledo Technologies LLC, a US software company. The tool and the kit were built because the deadline is real and the gap between "here are your CVEs" and "file or don't file, in 24 hours" is where teams actually get stuck.