When something in your product turns out to be exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof.
You submit it. A filing is a legal statement from you, not from a tool, so that step is always yours, not ours.
This has been EU law since 11 September 2026, and it applies to products already on the market. Miss the filing and the fines dwarf the cost of making it.
This is what comes out the other side, filled in and ready to paste:
Early Warning package (excerpt)
- CVE ID
- CVE-2026-41234
- Manufacturer name
- Nimbus Sensors GmbH
- Product name
- Nimbus Edge Gateway 3.4.1
- Title
- Actively exploited path traversal in the Nimbus Edge Gateway TLS termination module
The mechanic underneath: three deadlines, running from the moment you become aware, not from when you open the portal.
- 09:00Awareness
- 23h 42mEarly Warning
- 2d 9h72-hour Notification
- pending fixFinal Report
Get the regulatory changelog by email
We watch ENISA's guidance pages for changes that could affect your filing, and email you when one happens. That means it may be quiet for weeks: the first email won't go out until there's something worth sending.
Tell us where to send the link when it opens
No call, no commitment. Just an email for when the product itself is ready to use.
craclock never submits anything on your own behalf. It prepares the text; a person at your company pastes it into ENISA's portal, on purpose, because a filing is a legal statement by the manufacturer, and that statement should never come from software acting alone.
ENISA's portal has no API and doesn't record when you first knew; craclock does.
Email reaches the people building craclock, not a support queue.