An exploited vulnerability in your product? 24 hours to report to the EU.
Watchpost keeps checking whether your products are affected by actively exploited vulnerabilities. The moment one is found, the countdown starts, the owner and backup are alerted, and the checklist is prepared — so someone reports on time, and there is a record.
Built for hardware makers selling into the EU. We do not submit reports for you, and this is not legal advice.
What has to be reported, and by when.
All deadlines run from the moment you become aware of an actively exploited vulnerability or a severe incident.
| Stage | Deadline | What it covers |
|---|---|---|
| Early warning | 24 h | Notify that an actively exploited vulnerability or severe incident exists. Short, factual, no full write-up yet. |
| Notification | 72 h | Product and version, the vulnerability, the impact, and the measures taken or planned. |
| Final report | 14 days / 1 month | Closing report: 14 days after a corrective measure for an exploited vulnerability, or 1 month after the notification for a severe incident. |
Three steps, and the clock is covered.
Register products and components
Paste your product list and the main software components. That becomes the baseline we match against.
On a hit, confirm "we know"
We surface exploited vulnerabilities that match your components. You confirm the awareness time and the countdown starts on the server.
Follow the reminders, submit, mark done
Owner and backup get alerted at 12 / 4 / 1 hours and at the deadline. The checklist is ready for the ENISA platform.
Priced per product line.
Every plan includes the full monitoring and alert workflow, with no per-incident fees. Prices in RMB, billed yearly. Take the free check first to see how ready you are, then decide.
Starter
- 1 product line
- Alerts to owner + backup
- Weekly vulnerability match
- One-page submission checklist
Standard
- Up to 5 product lines
- Alerts to up to 5 people
- Time-stamped record of checks and responses
- Onboarding help: products and components set up once
Portfolio
- Unlimited product lines
- Unlimited alert recipients
- Priority manual review of matches
- Priority contact
A product line is a group of products that share one firmware platform or main chip. Different models on the same platform count as one line.
What people ask first.
Does Watchpost submit the report to ENISA for me?
No. ENISA's reporting platform has no API for now: submissions are made on the web by your own authorised user, signed in with a personal EU Login. Watchpost monitors, counts down, alerts and prepares the checklist, so that person can fill in the form quickly.
Are my products in scope of the CRA?
Products with digital elements sold in the EU are in scope. The free check gives you a one-page readiness report in about three minutes.
What happens if we miss the deadline?
Under CRA Article 64, breaching the reporting duty in Article 14 can bring a fine of up to €15M or 2.5% of worldwide annual turnover, whichever is higher, and market surveillance authorities may also require corrective action. Some deadline breaches are treated more leniently for micro and small enterprises. Check the regulation text or take legal advice for your case.
We already have CE or EN 18031. Is that enough?
No. Certification shows the state of the product at assessment time. The 24-hour reporting duty is continuous and starts after launch.
How is it different from a certification body?
A certification body helps you test and certify. Watchpost watches after launch: someone knows within hours, someone reports, and there is a record.
How is it priced?
By product line, billed yearly, never per incident. See the pricing section above. If your needs go beyond the tiers, email us.
What should we set up before an incident?
Set up the submitting accounts in advance: a corporate EU Login with multi-factor authentication for a primary representative, the coordinating CSIRT chosen and verified, and a deputy or two invited. Doing this on the day of an incident costs hours you do not have. We will remind you to check these when we set you up.
What do you need from us?
Product names and the main software components. We do not need firmware images or end-user data.
When a European buyer asks, have the answer ready.
Start with the free check, or email us.