Changelog

When Grype, Trivy or Dependency-Track turns up something in your product that's actually being exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof of when you knew and what you filed. You submit it yourself: a filing is a legal statement by you, not by a tool, so craclock hands you the finished text instead of sending it for you.

When a regulator changes a field, deadline or portal layout, craclock ships a new ruleset version. Cases already open keep running on the version they started with.

eu-cra-art14 2026.09.1

Effective 12/09/2026

Initial release of the eu-cra-art14 ruleset: the Early Warning (24h), 72-hour Notification and Final Report deadlines; the 41 SRP portal fields across common, AEV-specific, SI-specific and additional-notes sections; the CDaC selection order; and the three Particular Exceptional Circumstances conditions. Built from ENISA’s SRP FAQ, Glossary, AR submission guidance, AR user manual and CSIRT coordinator list, plus the Commission’s CRA FAQ and 27 July 2026 guidance.