· ReadyStack
Worked example
Real numbers from this tool, line by line.
Six lines in one EU software maker's SECURITY.md were flagged against Cyber Resilience Act Article 14 on 17 October 2026, four of them blocking, and if you are the security lead at a software or connected-device company selling into Germany, France, the Netherlands or any other member state, these are the lines a coordinating CSIRT reads first.
| Line | What the file says | What Article 14 requires |
|---|---|---|
| 13 | Reports go through the single reporting platform "once ENISA launches it" | ENISA launched it on 11 September 2026 |
| 12 | Article 14 obligations apply from 11 December 2027 | Reporting applies since 11 September 2026 |
| 11 | "As with GDPR Article 33, we notify within 72 hours" | Two separate clocks, two separate recipients |
| 15 | A severe incident is reported to the European Commission | The coordinating CSIRT and ENISA |
| 6 | Reports acknowledged within 5 business days | The 24/72/14 clock stated separately |
| 19 | Security updates until 2028-06-30 | Five years from today is 2031-10-17 |
The full run on that file returned 8 findings out of 19 checks: 4 blocking, 4 to review. The two not shown above are document-level: no coordinated vulnerability disclosure policy is linked, and no SBOM is referenced, so the notification cannot list affected versions.
Why line 13 is the new one
ENISA opened the CRA Single Reporting Platform on 11 September 2026 at portal.cra-srp.enisa.europa.eu. A runbook written in the summer often says reports will be filed once it is available. Read at 3am, it tells the on-call engineer to wait. The early warning is due 24 hours after you become aware of an actively exploited vulnerability or a severe incident, and waiting for a platform that already exists burns that window. This check was added to the rule table on 17 October 2026, with the ENISA announcement as its source.
The clock, in the order you file
- Early warning within 24 hours of awareness, to the CSIRT designated as coordinator for your main establishment, with ENISA receiving it through the same submission.
- Notification within 72 hours, with severity, impact and any corrective measures taken.
- Final report no later than 14 days after a corrective or mitigating measure is available.
It covers products already on the market. Breaching Article 14 can draw fines of up to EUR 15 million or 2.5% of worldwide annual turnover under Article 64.
The two mistakes that look reasonable
The December 2027 date is real but belongs to the rest of the regulation; copied into the reporting section it moves your deadline fifteen months out. The GDPR 72-hour breach notice is also real, but it goes to a data protection authority about personal data; one incident can start both clocks, and a runbook that merges them sends one report to the wrong place.
What the free check does
Open the file in VS Code, run CRA 24/72/14: Check this file, and every finding appears with its line number, the article it comes from and one sentence to write instead. The free web page runs the same engine, nothing uploaded. The paid version widens the scope: one sweep across every Markdown file in the repository, a list of the checks answered nowhere, and a dated CRA-24-72-14-READINESS.md for the auditor file.
This is a document linter, not a legal opinion: it cannot tell you whether your product is in scope, only whether your written process survives the first 24 hours.
15 seconds — what it actually does
Questions people ask
What does CRA 24/72/14 Reporting Lint actually check?
It reads a SECURITY.md, disclosure policy or incident runbook and runs 19 checks against EU Cyber Resilience Act Article 14: the 24-hour early warning, 72-hour notification and 14-day final report, ENISA and the coordinating CSIRT as recipients, the ENISA Single Reporting Platform, both triggers, the wrong December 2027 date, the GDPR 72-hour mix-up and the declared support period.
Who is CRA 24/72/14 Reporting Lint for?
Security leads, product security engineers and open-source maintainers at companies that sell software or connected devices into the EU, in Germany, France, the Netherlands or any member state, who own a SECURITY.md or incident runbook and must show that it follows the Cyber Resilience Act reporting clock that has applied since 11 September 2026.
Why not just use a free SECURITY.md template or ask a chatbot?
Most SECURITY.md templates were written before the Cyber Resilience Act reporting duty existed, and a chatbot trained earlier cannot know that ENISA opened the Single Reporting Platform on 11 September 2026. This extension carries a dated rule table and names the exact line in your own file that breaks the 24-hour, 72-hour or 14-day step.
What is free in CRA 24/72/14 Reporting Lint and what does the licence add?
Free: the file you have open is checked against all 19 rules, in VS Code or the browser, with every finding, line number, article and suggested fix. The licence widens the scope: one sweep across every Markdown file in the workspace, a list of the checks answered nowhere in the repository, and a dated CRA-24-72-14-READINESS.md report for the auditor.
What does it cost compared with asking a compliance consultant?
The file check is free. The workspace sweep and dated report cost $29 once, with one licence key per person or team seat. One hour of EU product-compliance consulting typically runs $150-250, and a consultant still reads your SECURITY.md by hand. The extension reads it in seconds, offline, and cites the CRA article for every finding.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. CRA 24/72/14 Reporting Lint checks the file you open against 18 rules, each naming its legal or official basis, from a rule set dated 2026-09-20, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.