Awareness is a fact, not a feeling
The reporting platform does not independently capture the awareness timestamp for vulnerabilities — everything downstream runs from a date only you can defend.
For the person who signs the filing
The 24-hour clock does not pause for a spreadsheet.
CRA Article 14 gives you 24 hours from awareness of an actively exploited vulnerability to file an early warning naming every Member State where the product is available. Getting the clock right, the reasoning right, and the field-5 territory list right, under that pressure, is not a spreadsheet problem.
The clocks that apply to youTwo clocks, both load-bearing: the 24-hour early warning under Art. 14, and the final-report clock — 14 days from a corrective or mitigating measure for a vulnerability, one calendar month from submission of the 72-hour notification for an incident. Getting either wrong is not a rounding error.
Why this matters for compliance officers
What the paperwork stops telling you
The 39-field spec has traps
A listed territory that is not an EU Member State, a field that exceeds a character limit, a required field silently absent at your stage — the free Validator catches these before you open the platform.
A hash-chained register, not a folder of PDFs
Every case, every clock, every piece of triage reasoning, in one append-only ledger that refuses to export if it does not verify.
What this checks
Proof, not a pitch
The free Article 14 validator
Checks a draft submission against the platform’s 39-field specification before you open the platform — free, no account, forever.
Read moreBoth deadline clocks, computed correctly
The Register tier tracks the 24-hour and final-report clocks together, with the reasoning that defends each filing.
Read moreThe 24-hour clock does not pause for a spreadsheet.
Verification stays free, forever, at every tier. Start there.