Free CRA reporting clock check
Answer four questions and get the actual dates: early warning, notification, final report. It runs entirely in your browser — nothing is sent to us, and there are no cookies or analytics on this page.
Last reviewed 2026-09-04 · IncidentReady, Harmony Future Holdings Limited, Dublin
The same logic as the paid pack
The classifier below is a faithful port of the function our €490 pack uses, so the verdict and the dates match. What it cannot do is name your incident lead, pre-draft the notifications with your product versions in them, or produce the evidence register. The guide explains the obligations in full.
Nothing leaves your browser. This page has no analytics, sets no cookies and sends nothing to us. The calculation runs entirely on your device — you can disconnect from the network and it still works.
How the tool decides
It walks the four questions in the order our classifier asks them and applies exactly two rules that are worth knowing about:
- “Not sure” is treated as triggering. The corpus rule is that if you cannot decide, you treat the clock as running and start the log. A log you did not need costs an hour; a clock you started late cannot be un-started.
- Both tracks can be live at once. An event can be both an actively exploited vulnerability and a severe incident. When it is, both sets of obligations run — the tool shows both, because collapsing them into one verdict would understate a duty.
Why one deadline has no date
The final report on the vulnerability track is due within 14 days of a corrective or mitigating measure becoming available. It is anchored to the fix, not to awareness — so it genuinely cannot be calculated until you have a fix date. The tool says so rather than inventing one. The severe incident final report does have a date: one month after the 72-hour notification.
Privacy
This page has no analytics, sets no cookies, and makes no network requests once loaded. The whole calculation is JavaScript running on your device. You can open it, disconnect from the network, and it still works — which is worth knowing, because the facts you type into it during a real incident are sensitive.
Your runbook, specific to your company
The free tools on this site tell you what the law asks. The pack tells you who in your company does it, with the notifications already drafted and your product versions already in them.
Get the pack — €490