Moment of awareness
The case records when you became aware. That is when the clock starts.
CRA reporting
CRA reporting software for Article 14
CRA reporting software for the Cyber Resilience Act. When an actively exploited vulnerability or a severe incident comes in, it records when you became aware, runs the 24-hour and 72-hour clocks, and pre-fills each report from your own records.
Checked against the regulation on 16 Oct 2026 · What changed
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.
Runs in your hosting · Drafts from your records · Your representative submits
The clock starts when you know
The hard part is knowing when you became aware, and having a draft ready before the deadline.
Article 14 reporting has applied since 11 September 2026. An early warning is due 24 hours after you know of an actively exploited vulnerability. The notification follows at 72 hours. The final report is due 14 days after a fix for vulnerabilities, or one month after the notification for severe incidents.
Email threads don't show when you became aware, who approved the text, or what was sent. The desk keeps all three. It runs after, or beside, Article 14 Ready. That set-up is the runbook and the practice drill. This is the tool your representative copies from.
The clocks
Vulnerabilities and severe incidents do not share the same final-report rule.
From inbox to submission
The desk keeps the record. Your representative still files it.
- Inbox
- Case
- Clock
- Draft
- Approval
- Your representative submits
What a case looks like
Illustration
Sample case 001 · sample data
- Aware
- Recorded
- Clock
- 24h running
- Draft
- Early warning
- Submit
- Your representative
What the desk does
It records the start, shows the deadlines, and keeps what your representative submitted.
The right deadline
Early warning, notification and final report, with the final-report rule that matches vulnerabilities or severe incidents.
Pre-filled stages
Each stage is structured to match the fields in ENISA's published platform guidance, so your representative can copy it across.
Who approved what
The desk tracks the approval. It does not decide for you.
A full copy
Everything submitted is kept, including the notice drafted for affected users.
Your existing tools
We build it to connect to your ticketing, disclosure inbox and alerts, and it runs in your hosting.
In use
A report in the inbox becomes a case with a clock, then a draft your representative can file.
A researcher emails your security inbox. The case opens, someone marks it as actively exploited and records why, and the 24-hour clock starts. The early warning is drafted from the case, approved, and copied into ENISA's platform by your representative.
How it works
We put the desk on your product, in your hosting, after the process is clear.
Call
How reports reach you today, and who would submit.
Brief
Clocks, fields and the tools we connect to.
Build
The desk, in your accounts.
Launch
A practice case, not a live incident.
Handover
Code, docs and access are yours. We stay on call for 30 days.
What you get, and what we need
You get the working copy. Your representative still files it.
What you get
- Awareness time and the 24-hour and 72-hour clocks.
- Drafts in the order of ENISA's form.
- A record of approvals and of what was submitted.
- The software in your own hosting.
What we need from you
- The person who submits, and a backup.
- Where reports arrive today.
- Access to the hosting it will run in.
- A runbook, or time to write one first.
Why a software studio for this
A reporting desk is not a project we've worked on before.
Questionnaire engines with job queues and role-based platforms are, and they use the same building blocks.
Related
Questions
Does the desk submit to ENISA?
No. Your named representative submits on ENISA's Single Reporting Platform. The desk prepares the content and keeps the record. We do not submit reports for you.
What counts as actively exploited?
In the CRA, that is a vulnerability for which there is reliable evidence that a malicious actor has exploited it. The desk asks you to record why a case was marked that way. Your team, or your adviser, makes the call.
Do we need this desk for products we launched years ago?
Reporting applies to products already on the EU market, so yes, those cases need a home. The desk is one option. A practised runbook is the minimum.
What if the desk is down?
Your runbook says to submit directly on ENISA's platform. The desk is the working copy, not the only door.
Samisoftz builds the process and software your team uses to organise CRA evidence and reporting. You stay responsible for meeting the regulation. We don't give legal advice, act as a notified body, or submit reports for you.
On a delivery date agreed in writing, your team will know who decides, what to send at 24 and 72 hours, and will have practised it once on your own product. The decision to report stays with you. We set up how.
Could your team send a 24-hour early warning tomorrow? Find out in 30 minutes.
You'll talk to Usama, who'd build it.
30 minutes · no slides · a written answer if it's not a fit
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.