Answer 10 questions and get a one-page CRA reporting-readiness report you can send to your boss: your score, your gaps, what to fix first.
Who reports, who is the backup, and how brand owners, OEMs and traders split the duty.
Can you log in to the ENISA reporting platform, and can outside researchers reach you.
Can you reach a decision maker on weekends and holidays, and write the report the same day.
Do you know what components are inside, and can you ship and push a patch.
10 questions: could you report within 24 hours after an incident?
Start below ↓Is your product in scope, which class, which assessment route.
Open → STEP 0321 essential requirements, with gaps and the evidence to prepare.
Open →This is a self-check. It gives organised suggestions, not legal advice or a compliance certification.
Submitted through ENISA’s Single Reporting Platform. It is a web form with no API and requires an EU Login account.
Copy the text below and send it to your owner or boss.
We are building Watchpost: when an exploited vulnerability is found it starts the 24-hour countdown, alerts the owner and backup as the deadline nears, and drafts the English report for each stage for your authorised staff to review and copy into the ENISA platform. Watchpost does not submit on your behalf. It is software, not a 24-hour human service.
More free self-checks: scope and class, Annex I gap check.
Read more: CRA overview, readiness checklist, 24-hour reporting guide.
To be among the first to try Watchpost, or to get more specific advice from your result, submit it below.
This page does not collect or save your answers automatically. We only receive what you submit through the form, use it only to contact you, and delete it on request. Please do not enter real vulnerability details. (The form is in Chinese.)
Basis: EU Cyber Resilience Act (Regulation (EU) 2024/2847), Article 14. Reporting duties apply from 2026-09-11, the remaining obligations from 2027-12-11. Rely on the official text and professional advice.