CRA Article 14 deadline calculator
Enter the moment you became aware of an actively exploited vulnerability or a severe incident. You get every reporting deadline, in your local time and in UTC.
The moment your initial assessment reached a reasonable degree of certainty — not the moment of detection. Times use this device's time zone: .
This starts the 14-day clock for the final report.
This starts the one-month clock for the final report.
Enter the moment you became aware to see your deadlines.
How these deadlines are calculated
- They are outer limits. Article 14 requires filing without undue delay, and in any event within 24 and 72 hours.
- They use the strictest reading: exact hours from the triggering moment, and calendar days and months with no rounding and no weekend extension. Where a time zone or a daylight-saving change could move a date, the earlier result is shown. Filing by these times is on time.
- The ENISA platform's own 72-hour counter shows a due date 48 hours after your early warning is submitted, not 72 hours after you became aware. Keep your own clock.
- The coordinating CSIRT may also request an intermediate report at any time, with a deadline it sets (Article 14(6)).