Report an actively exploited vulnerability within 24 hours
Article 14 of the Cyber Resilience Act: from the moment you become aware of an actively exploited vulnerability in a product you sell in the EU, you have 24 hours to send an early warning, 72 hours for the notification, then a final report, all through ENISA’s Single Reporting Platform. These obligations apply since 11 September 2026.
The job
Your scanners and teams already log vulnerabilities in Jira. When one turns out to be actively exploited, you must know which products and versions are affected, send each report on time, fix, inform users, and keep a record you can show later.
Before
- The vulnerability sits in Jira like any other bug. Nobody wrote down when the team became aware of the exploitation.
- Someone searches release notes and dependency lists to find the affected versions.
- The reports are typed into the ENISA platform from memory, and nothing keeps what was sent, or when.
- Months later, the market surveillance authority asks for the file. It is spread over e-mails and chats.
After, with Clearlane CRA
- From the scanner’s work item, a signed, dated qualification records whether the vulnerability is actively exploited, and when you became aware of it.
- Three clocks start: early warning in 24 hours, notification in 72 hours, final report 14 days after the fix.
- Search every SBOM (CycloneDX or SPDX) for the component and version range; one click opens a case for all the versions found.
- For each report, the ENISA fields are ready to paste, with the platform’s own labels and length limits.
- Record the fix, inform users with a notice prefilled from the case (Article 14(8)), publish a CSAF 2.0 advisory, and close with a PDF evidence file that holds the signatures.
What sets it apart
- The clock starts when you knew. Not when the ticket was created: the signed qualification is the reference.
- From component to products. SBOMs per version make “which products ship this?” a search, not a project.
- One PDF file for the ten-year retention of Article 13(13). Facts, decisions, reports, fix, notice, advisory and signatures, attached to the Jira work item; keeping it with your technical documentation is up to you as the manufacturer.
- Runs on Atlassian. Your data stays in your Atlassian site.
What it does not do
ENISA’s platform currently offers no API for submissions: Clearlane CRA never submits anything on your behalf, and the decision to report stays yours. It helps you meet the reporting and vulnerability handling requirements; your own assessment still applies.