cra-incident-clocks

What problem does it solve?

EU manufacturers, importers, and distributors of products with digital elements face strict statutory deadlines for reporting actively exploited vulnerabilities and severe security incidents under the EU Cyber Resilience Act (CRA) Article 14, with fines of up to 2.5% of global annual turnover for late, incomplete, or missing filings. Manually tracking the 24-hour, 72-hour, and 14-day reporting clocks, plus populating all required ENISA single reporting platform fields, is error-prone and high-risk for compliance teams.

Core Features & Use Cases

• Statutory Clock Tracking: Automates tracking of the three mandatory CRA Article 14 reporting deadlines (24-hour early warning, 72-hour notification, 14-day final report) from the moment of organizational awareness, with clear workflow steps for each submission type and mandatory 30-day handling report for unresolved incidents.
• ENISA Conformant Reporting: Generates pre-populated, schema-valid JSON for all CRA Article 14 report types, including all required fields for the ENISA single reporting platform, with support for unknown field justification and superseding report linkage for amended filings.
• Use Case: A SaaS company discovers an actively exploited zero-day vulnerability in their EU-distributed mobile application; use this skill to file the 24-hour early warning within the statutory window, update it with full details at 72 hours, and submit the final report once a patch is released, avoiding costly regulatory penalties.

Quick Start

Use the cra-incident-clocks skill to file a 24-hour early warning report for the actively exploited CVE-2026-XXXXX vulnerability affecting your EU-distributed product, including all required ENISA platform fields and audit log entries.