Two clocks, one deadline
ENISA's reporting platform shows a 72-hour counter with a due time 48 hours after your early-warning submission. The law counts 72 hours from awareness, the instant you enter in the platform's awareness field. Enter both instants and see the gap.
Your instants
Nothing you type leaves this page. It is arithmetic on dates, done in your browser.
Your deadlines
Why the two counters disagree
The law
Article 14(2) counts 24 hours and 72 hours from the moment the manufacturer becomes aware. The final report is due 14 days after a corrective or mitigating measure is available; for a severe incident, one month after the 72-hour notification.
The platform, today
Its 72-hour counter shows a due time 48 hours after your early-warning submission (ENISA FAQ Q26). File the early warning inside its 24 hours and the portal will flag you as overdue before the legal 72 hours are up; file it late and the portal is generous. ENISA has said a later release will count from the awareness field, which the vulnerability form does not have yet.
What to do
Work to the legal clock; treat the portal's counter as a reminder, not a deadline. On the vulnerability form, state the awareness time in words in your summary. Keep your own dated, tamper-evident record of when you became aware and who decided, because that is what an authority will ask for.
ExploitClock runs both clocks for you, on every case
The legal deadline from awareness, the platform's counter from submission, alerts before either runs out, and a hash-chained record of how and when you established awareness.