EU Cyber Resilience Act · Article 14 · applies since 11 September 2026
An exploited vulnerability starts your 24-hour CRA clock.
ExploitClock watches your SBOMs for exploited components, starts the EU Cyber Resilience Act Article 14 clocks when you confirm, drafts the ENISA notification field for field, and keeps the proof.
From €79/month per product line. Team-level access during the trial.
- Hosted in Frankfurt (EU)Frankfurt, Germany (EU)
- DPA on every planRead it before you sign up
- Evidence exportablehash-chained, RFC 3161 receipts
- Live statusUptime and feed freshness
- 8vulnerabilities added to CISA KEV in the last 7 days
Are you in scope?
Three questions. If all three are yes, Article 14 applies to you.
- ✓You place hardware or software with a digital element on the EU market, under your own name or brand.
- ✓It is not already covered by sector rules that displace the CRA, such as medical devices, civil aviation or type-approved vehicles.
- ✓You still support it after 11 September 2026. Products you sold years ago count too (Art. 69(3)).
If all three are yes: 24 hours to an early warning, 72 hours to a notification, 14 days after a fix to a final report. Read the Article 14 guide · Not sure? Run the CRA Scope Check
How ExploitClock does it
Exploitation-triggered, not CVE-triggered. Your SBOM is the input; a filed notification with proof is the output.
Upload your SBOM, or try the sample
CycloneDX or SPDX via the UI, the API, a GitHub Action or a Dependency-Track import; syft, cdxgen and Trivy output works.
We watch it every 15 minutes
Against OSV, cross-referenced with CISA KEV, ENISA EUVD and FIRST EPSS; noise stays noise, exploitation opens a case.
You decide: affected or not
The clocks start at your decision, or you dismiss with a justification; either way it is logged.
The form arrives pre-filled, alerts escalate, proof accrues
SRP field sheet in the portal's order, alerts by email, Slack or Teams and webhooks until someone acts, every step hash-chained and timestamped daily by an RFC 3161 authority.
Around the case: Vulnerability inbox for researchers' reports, on every account · Jira and GitHub tickets for the fix work · Advisories for your users on a public page, with CSAF 2.0 files and customer emails.
The SRP has no API. What we do, and what we do not do.
ENISA's Single Reporting Platform provides no API at its initial release (ENISA's own FAQ). Your Assigned Representative files in the portal with EU Login and MFA; we hand them every field in the portal's order and a browser fill payload, and record the reference. When ENISA publishes an API, we will submit directly.
- We do not file on your behalf.
- We hold no SOC 2 report and no ISO 27001 certificate today.
- This is not legal advice; every rule we apply is cited on /regulatory.
Simple per-product pricing
Questions manufacturers ask
Is a CISA KEV listing enough to start the clock?
Usually it is the trigger for an assessment. You still have to confirm the vulnerable code is present and reachable in your product. ExploitClock opens the case at detection, times your assessment, and starts the legal clock when you confirm, or lets you record not affected with a justification. If you prefer the conservative reading, one setting starts the clock at detection.
We already run a vulnerability scanner. Why this too?
A scanner tells you a CVE exists. Article 14 is about exploitation and about deadlines: whether this vulnerability is actively exploited, when you became aware, what you filed within 24 and 72 hours, and whether you can prove it a year later. ExploitClock consumes your SBOM, watches exploitation feeds, runs the clocks and produces the filings and the evidence.
Where is my data?
Stored and processed in Frankfurt, Germany (EU), and backups stay in the EU. Three US-operated lookup services receive identifiers from your SBOM and nothing else: component identifiers go to OSV.dev, CVE ids to FIRST EPSS, and the CPE strings (vendor, product, version) of components that carry a CPE go to NIST NVD. CISA KEV and ENISA EUVD are downloaded in full and matched locally. Support access from outside the EU is covered by our standard contractual clauses. See Security and Privacy.
Who is behind ExploitClock?
A named operator with a published imprint, a data processing agreement on every plan, EU hosting and a public status page. We are new, which is why everything you would need to leave — your SBOMs, cases, filings and the evidence chain with its timestamp receipts — is exportable in open formats at any time. Imprint.
The obligation is live. Be watching before the next exploited vulnerability, not after it.
Set it up in twenty minutes: upload one SBOM, add a deputy, point the alerts at the channel you actually watch, and run one drill.