Free tools
Eight micro-tools for CRA readiness
Reviewed August 2026 against Regulation (EU) 2024/2847, OJ L, 20.11.2024.
Reading the CRA is one thing; doing the work is another. The first seven tools run entirely in your browser. They need no account, send nothing to any server, and the results stay on your device. The eighth is for agents and scripts and calls the Cybiq API. Each one maps to a concrete obligation so you can act on it in time.
1. security.txt generator (RFC 9116)
A security.txt file, placed at /.well-known/security.txt, tells security researchers how to reach you with a vulnerability. It is the practical front door for the coordinated vulnerability disclosure the CRA expects.
“vulnerabilities of a product with digital elements are handled effectively and in accordance with the essential cybersecurity requirements”
“A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA.”
2. Support-period calculator (Art. 13(8))
Manufacturers must declare a support period. The law sets a floor, but a shorter expected in-use time can lower it. Enter how long the product is expected to stay in use.
“the support period shall be at least five years”
“Where the product with digital elements is expected to be in use for less than five years, the support period shall correspond to the expected use time.”
“the end date of the support period referred to in paragraph 8, including at least the month and the year, is clearly and understandably specified at the time of purchase”
3. Coordinated vulnerability disclosure (CVD) policy template
Annex I, Part II, point (5) requires a policy on coordinated vulnerability disclosure. This is a short, publishable one: it tells researchers you will not sue them for good-faith reporting, states your commitments, and names both the contact address required by point (6) and the single point of contact required by Art. 13(17). It pairs with the security.txt above.
“put in place and enforce a policy on coordinated vulnerability disclosure”
“providing a contact address for the reporting of the vulnerabilities discovered in the product with digital elements”
“manufacturers shall designate a single point of contact to enable users to communicate directly and rapidly with them, including in order to facilitate reporting on vulnerabilities of the product with digital elements”
“vulnerabilities of a product with digital elements are handled effectively and in accordance with the essential cybersecurity requirements”
“an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it”
“a vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively exploited vulnerability”
4. Article 14 reporting routing card
Article 14 has applied since 11 September 2026 and binds manufacturers. This card answers two questions: which CSIRT coordinator end-point your notification goes to, and what the clocks are once you become aware. It states the rule and never names a national CSIRT, because the Regulation names none and the list of designated coordinators belongs to the Member States.
“A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA.”
“a single reporting platform shall be established by ENISA”
“The architecture of the single reporting platform shall allow Member States and ENISA to put in place their own electronic notification end-points.”
“The notification shall be submitted using the electronic notification end-point of the CSIRT designated as coordinator of the Member State where the manufacturers have their main establishment in the Union and shall be simultaneously accessible to ENISA.”
“the Member State where the decisions related to the cybersecurity of its products with digital elements are predominantly taken”
“Where a manufacturer has no main establishment in the Union, it shall submit the notifications referred to in paragraphs 1 and 3 using the electronic notification end-point of the CSIRT designated as coordinator in the Member State determined pursuant to the following order”
“an early warning notification of a severe incident having an impact on the security of the product with digital elements, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it”
“an incident notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident”
“a final report, no later than 14 days after a corrective or mitigating measure is available”
“a final report, within one month after the submission of the incident notification under point (b)”
“may request manufacturers to provide an intermediate report on relevant status updates”
“the manufacturer shall inform the impacted users of the product with digital elements, and where appropriate all users, of that vulnerability or incident”
5. Annex V declaration of conformity generator
The EU declaration of conformity is the document you issue and ship with the product. Article 28 requires the manufacturer to draw it up; Annex V sets out the eight numbered items it must contain. This tool formats your own entries into those eight items and labels each one with its Annex V number, so nothing is quietly left out.
It is a different file from the technical documentation, whose content is set out in Annex VII. The simplified declaration under Art. 13(20) is not part of this tool.
“EU DECLARATION OF CONFORMITY”
“The EU declaration of conformity referred to in Article 28, shall contain all of the following information”
“The EU declaration of conformity shall be drawn up by manufacturers in accordance with Article 13(12) and state that the fulfilment of the applicable essential cybersecurity requirements set out in Annex I has been demonstrated.”
“Name and type and any additional information enabling the unique identification of the product with digital elements”
“Name and address of the manufacturer or its authorised representative”
“A statement that the EU declaration of conformity is issued under the sole responsibility of the provider”
“Object of the declaration (identification of the product with digital elements allowing traceability, which may include a photograph, where appropriate)”
“A statement that the object of the declaration described above is in conformity with the relevant Union harmonisation legislation”
“References to any relevant harmonised standards used or any other common specification or cybersecurity certification in relation to which conformity is declared”
“Where applicable, the name and number of the notified body, a description of the conformity assessment procedure performed and identification of the certificate issued”
This tool formats the entries you type into the eight Annex V items. Whether the product actually conforms is decided by the work behind the declaration, not by the file. Sign and date the copy you issue.
6. Is this vulnerability or incident reportable? Article 14 check
Two or three questions about a vulnerability or an incident you have just found. The check says whether Article 14 requires a notification, which deadlines apply and which provisions the answer rests on. It keeps nothing, and Cybiq never files or transmits anything on your behalf.
7. Is my cloud backend part of the product? Remote data processing check
Up to three questions about the backend your product relies on. The check applies the definition in Art. 3, point (2) and Commission guidance, section 8.1 to say whether the backend is part of your product with digital elements.
8. Reporting deadlines for agents (MCP and API)
This one is for agents and scripts, not for the browser. The MCP tool compute_reporting_deadlines and POST /api/deadlines take the moment a manufacturer became aware of an actively exploited vulnerability or a severe incident, and return the 24-hour and 72-hour outer limits on their earliest reading, and the 14-day or one-month final-report limit once you give the timestamp that starts it, with a calendar file. You supply the awareness timestamp. There is no browser calculator by design, because the clock starts from a fact only you know. Cybiq never files or transmits anything on your behalf.
Example request:
curl -s https://cybiq.eu/api/deadlines \
-H 'Content-Type: application/json' \
-d '{"kind":"vulnerability","awareness":"2027-03-10T08:30:00+01:00",
"measureAvailable":"2027-03-12T00:00:00Z","locale":"en"}'
Response, shortened (each deadline also carries runsFrom, pinpoint, label and dueNote, and the response adds locale, method, sources, notice and disclaimer):
{
"schema": "cybiq.deadlines/v1",
"kind": "vulnerability",
"awareness": "2027-03-10T07:30:00Z",
"deadlines": [
{ "filing": "early_warning", "dueBy": "2027-03-11T07:30:00Z",
"basis": "cra-art14-2a-vuln-early-warning" },
{ "filing": "notification", "dueBy": "2027-03-13T07:30:00Z",
"basis": "cra-art14-2b-vuln-notification" },
{ "filing": "final_report", "dueBy": "2027-03-26T00:00:00Z",
"basis": "cra-art14-final-report-vuln-14d" },
{ "filing": "intermediate_report", "dueBy": null,
"basis": "cra-art14-6-intermediate-report" }
],
"ics": "BEGIN:VCALENDAR ..."
}
Orientation, not legal advice. These tools format your own inputs and quote the law verbatim; they do not assess whether the CRA applies to your product. Verify before relying on any output, and confirm the quoted articles against the current Official Journal text.