For one-person SaaS & tiny vendors selling into the EU
THE CLOCK STARTS
WHEN YOU FIND OUT.
Since 11 Sep 2026, even a one-person software vendor selling into the EU must report an actively exploited vulnerability within 24 hours (early warning) and 72 hours (full notification) under the EU Cyber Resilience Act — via ENISA's Single Reporting Platform. By 11 Dec 2027 you also need an SBOM, a conformity file and update evidence. CRAClock packages all of it for micro-vendors.
Free — one product, complete job, no signup
Generate your SBOM + readiness pack
Paste a real dependency manifest — requirements.txt, package.json or Pipfile.lock. We parse the actual packages and versions and return a CycloneDX SBOM, a dated CRA readiness checklist computed from that SBOM, and a pre-filled 24h/72h reporting runbook.
Paid · Pro / Team
Live CVE monitoring
Your SBOM is matched against live OSV.dev vulnerability data — real CVE ids, shown per component. No mock feeds.
Paid · Pro / Team
Reporting-clock automation
Mark a matched CVE as actively exploited and the clock starts: deadlines computed, and your 24h early-warning report drafted for one-click review. You submit it yourself in ENISA's platform — we never claim to submit for you.
Paid · Pro / Team
Disclosure intake + evidence vault + trust page
A hosted disclosure page per product, a conformity evidence vault, and a customer-facing “CRA-ready” trust page for procurement questionnaires.