Three reports, three clocks
Under Article 14 of the CRA, an actively exploited vulnerability or a severe incident triggers a fixed reporting sequence. Warnclock tracks each step from the moment you became aware.
Early warning
A first alert that you are aware of the issue, and which EU countries it may affect.
Notification
The general nature of the issue, any fixes or workarounds, and how sensitive the information is.
Final report
Due 14 days after a fix is available for a vulnerability, or one month after notification for an incident.
Everything in the place your team already works
No new tool to learn. Warnclock adds a project page and an issue panel to Jira Cloud.
Start the clock from any issue
Flag an issue as an exploited vulnerability or severe incident and every deadline is set straight away.
Report drafts, ready to copy
Each report is drafted from the case details, so you can paste it into the official submission.
Every report due, in one view
See all open cases in a project, sorted by the next report due.
Your EU products, listed
Keep each product's CRA category, support period and vulnerability contact together.
Annex I checklist
Work through the essential requirements and main manufacturer obligations, product by product.
SBOM checks
Upload a CycloneDX or SPDX file and see which components are missing a version, package URL or licence.
Your data stays in your Jira
Be ready before the next 24-hour clock starts
Warnclock is in review for the Atlassian Marketplace. Email us for early access or a short demo.