Free check

If you ship software, this starts in September

The Cyber Resilience Act makes reporting a live vulnerability a 24 hour job from 11 September 2026, and it covers what you have already shipped. Five questions and this page says whether it reaches you. The answers stay in this tab unless you ask us to email you the result, and an account is never needed.

1days until an actively exploited vulnerability has to be reported within 24 hours.

FourWinds Digital · fourwindsdigital.com

Cyber Resilience Act check

Regulation (EU) 2024/2847

A scoping result produced from the answers given on the page. It says which conversation you are in. It is not legal advice, and it is current as at the date it was printed.

This is a scoping result worked out from your own answers. It tells you which conversation you are in. It is not legal advice, and it is not a determination that you comply.

What was answered

Optional, and nothing in the answer depends on it. It goes onto the result if you print it, so the document says which product it was run for.

Does a customer install, embed or run any part of it themselves?
01Does a customer install, embed or run any part of it themselves? Not answered

Does a customer install, embed or run any part of it themselves?

A desktop program, a mobile app, a browser extension, firmware, an on-premise agent, a library shipped separately. Answer no if everything runs on your servers and the customer only ever opens a browser.

Did you make it, or is your name on it?
02Did you make it, or is your name on it? Not answered

Did you make it, or is your name on it?

Building it counts, having it built for you counts, and putting your own name or trademark on somebody else's product counts. Reselling under their name does not.

Do you make money from it, in any way?
03Do you make money from it, in any way? Not answered

Do you make money from it, in any way?

Charging for it, charging for support beyond your costs, monetising a platform around it, or requiring data for reasons other than making it work. Free and genuinely unmonetised is outside the Act. Donations above your costs are not.

Is its main job one of these?
04Is its main job one of these? Not answered

Is its main job one of these?

Password manager, VPN, single sign-on or multi-factor authentication, network management, SIEM, antivirus, browser, boot manager, firewall, intrusion detection, hypervisor or container runtime, operating system, router, smart home camera or lock, connected toy, health wearable.

Is any version already in customers' hands?
05Is any version already in customers' hands? Not answered

Is any version already in customers' hands?

Anything shipped, downloaded or installed before now, including versions you no longer actively sell.

Answer all five and the answer appears here.

Why this one catches people out

Two reasons. The scope test does not match how anybody describes their own business: browser-only software is outside the Act, but ship a mobile app and the backend it talks to comes in with it. And the September date is fifteen months ahead of the requirements it relates to, so a product built long before any of this applied is still one whose vulnerabilities have to be reported on a clock.

Ireland has not yet named a market surveillance authority for it. That changes who chases you, not what is due.

Running AI rather than shipping software? The AI Act transparency check is the other one with a date on it.

Talk to us about the reporting process