The questions people ask us before signing

The reporting obligations of Art. 14 apply from 11 September 2026. The other manufacturer obligations and the essential requirements of Annex I apply from 11 December 2027. If you already have products on the market, the duty to report exploited vulnerabilities applies from the first date, regardless of when the product was placed on the market.

Two categories: actively exploited vulnerabilities contained in the product and severe incidents affecting the security of the product. Vulnerabilities that are merely discovered or disclosed without evidence of exploitation need not be reported, nor malfunctions with no security relevance. The difference must be documented: a reasoned “no” counts as due diligence, a silent “no” does not.

Reliable evidence that someone has exploited the vulnerability in a system without authorisation: logs of unauthorised execution, a working exploit in circulation, confirmation from a CSIRT or from a customer with evidence. Theoretical suspicion is not enough; confirmation of a single real case is.

Yes. After notifying the authorities, the manufacturer informs the users of the affected product without undue delay and, where appropriate, indicates the corrective or mitigation measures they can adopt. The notice must be kept: it is the proof that the market was informed.

It must be reported to the component's maintainer, in addition to the obligations towards the authorities if the exploitation precondition is met. In the application the task appears automatically when the product's SBOM contains third-party components, with the maintainer's contact already available.

No, and that's deliberate. Filing on ENISA's Single Reporting Platform is an act of the manufacturer, with its own EU Login credentials and its own signature. The application prepares the final text, locks it with a timestamp, guides you field by field through the form and stores the receipt you upload. No intermediary comes between you and the authority.

Half a day. You register the products, including by importing them from CSV; you designate the contacts with escalation tiers and alert thresholds; you publish the public reporting form; you create the EU Login credentials. The drill mode lets you try the entire flow without producing acts with legal value.

The deadline runs from the moment of awareness, which in the triage is recorded with the exact date and time. From that moment the case shows the time remaining, the elapsed-time bar and the reminders at −12, −8, −4 and −1 hour, sent to the contact of the corresponding tier on Slack, Teams or email.

A single ordered PDF: case and product record, the report as it was received with attachments, the triage path with the regulatory basis applied, the communication drafted and filed, receipts and confirmations, related obligations (Art. 14(8) and 13(6)) and the full chronology with the integrity-check identifiers of every entry.

Yes. Each company has a separate register, products and users; the same user switches between them from the selector and every switch is recorded. Each company counts its own Managed Products, and the separation can be made contractual as well as technical under an enterprise agreement.

The qualification remains yours, but it does not remain implicit. Each step records the answer, the article applied, the author and the time: if you decide the obligation does not arise, the reasoning is written and defensible. It is the opposite of silence, which cannot be explained under inspection.

No. The SBOM integrations and the APIs are optional. Those who already use Dependency-Track, Syft, Snyk, Black Duck, FOSSA, JFrog Xray, Mend or GitHub's dependency graph connect them and see third-party components appear in the cases; those who do not use them work with the product register filled in by hand or via CSV.

Yes, with an iframe to paste in: configurable fields (product and version, attachments, PGP key, anonymous reporting), editable introductory text, a dedicated email alias and a white-label appearance. Each submission opens a timestamped case and returns a tracking number to the reporter.

Yes: endpoints for cases, triage, notifications and the register, plus HMAC-SHA256-signed webhooks for events (case created, triage completed, deadline approaching, notification filed). Each key has selectable permissions and can be rotated with 24 hours of overlap.

Roles (administrator, assessor, billing only, read only), access requests with administrator approval, two-step verification with recovery codes, management of active sessions and a log of every change to permissions.

In the European Union. The activity register is kept for five years, in line with the need to demonstrate due diligence. The processing is governed by an agreement under Art. 28 GDPR, with a public list of sub-processors.

Yes. Each entry carries an identifier computed from its timestamp, content and references: changing a single character produces a different identifier, so any alteration is evident on comparison. The register can be exported to CSV and is reproduced in full in the defensive dossier.

Only to propose the descriptive draft of the event from the report received, and the text must always be validated by a person. The qualification, the calculation of deadlines and the filing are not entrusted to generative models. The details are on the page about the use of AI.

Breaches of the obligations under Articles 13 and 14 of the Cyber Resilience Act may lead to fines of up to €15 million or 2.5% of total annual worldwide turnover, depending on the breach, the party and the circumstances set out in the regulation. Added to this are market-withdrawal measures and the commercial damage towards customers who require conformity in tenders.

Monthly or annual subscription with two months included, card payment via Stripe; on request bank transfer, 30-day invoice, SEPA direct debit or orders by administrative decree. No multi-year commitment: cancellation takes effect at the end of the paid period and you export the register and the dossiers.

Yes, with a different use: they track the reports received, forward them to the manufacturer and document that they have done so. The price follows the Managed Products you declare, so a small catalogue costs little; if you sell third-party products under your own brand, the manufacturer's obligations apply.

We run guided drills on your process and support the team during the first real reports. We are not a law firm and we don't give legal advice: on the qualification of borderline cases we work with your adviser.