Three ideas explain most of how craclock works. None of them require having read the Cyber Resilience Act.

What a case is

A case is craclock’s record of one reportable event: one actively exploited vulnerability, or one severe incident, in one product. It holds the notification type, the product and version it affects, its own set of deadlines, and the packages you generate at each stage. Opening a case is the first concrete step in a report; every deadline, reminder, and package comes from it.

A case moves through a fixed set of stages, from opened, to each notification due, to closed. It can also be withdrawn at any point, if you later decide the event wasn’t reportable after all.

Why the clock runs from awareness, not submission

Article 14 counts its 24-hour and 72-hour windows from the moment you became aware of a reportable vulnerability or incident, not from the moment you finish a form. craclock asks you to record that moment once, as awareness_at, and it’s immutable from then on: editing it later requires a reason, and the old value stays visible.

This distinction matters because it’s easy to get wrong the other way around. A clock that quietly started counting from “whenever you got around to submitting” instead of “whenever you actually knew” would flatter whoever’s slowest at paperwork. craclock doesn’t work that way.

What a ruleset is, and why a case is pinned to one

The fields ENISA’s portal asks for, their order, which ones are required at which stage, and how each deadline is calculated: none of that is hardcoded in craclock. It’s data, called a ruleset, versioned like eu-cra-art14/2026.09.1. When the regulator changes a field or a deadline, craclock ships a new ruleset version rather than a new release.

A case, once opened, is evaluated by whichever ruleset version was current at that moment, for its entire life. A newer ruleset never reaches back and changes a case that’s already running. That’s deliberate: it’s what makes shipping a regulatory update safe to do automatically, since it can never retroactively move a deadline you’re already working against. See the changelog for every version that’s shipped.