CRA Article 14 reporting has applied since 11 Sep 2026

The PSIRT analyst your product team never hired.

Replaces
a dedicated PSIRT analyst
For
EU device, software and IoT makers

Vigil is a vertical AI agent for small device, software and IoT makers selling into the EU. It watches every SBOM you ship against actively exploited vulnerabilities, decides what is reportable under the Cyber Resilience Act, and drafts your 24-hour early warning before the clock runs out.

Open the live demo Join early access

The problem

A 24-hour legal clock, and nobody whose job it is to watch it.

Manufacturers must notify actively exploited vulnerabilities in their products through ENISA's Single Reporting Platform, starting with an early warning within 24 hours of becoming aware.[1] Large vendors run PSIRT teams for this. A small maker usually has an engineering lead with a day job and a spreadsheet of components.

to submit an early warning after becoming aware of an actively exploited vulnerability, then 72h for the full notification.
24h[1]

to submit an early warning after becoming aware of an actively exploited vulnerability, then 72h for the full notification.

or 2.5% of worldwide annual turnover, whichever is higher: the maximum fine for breaching Art. 13 or Art. 14.
€15M[1]

or 2.5% of worldwide annual turnover, whichever is higher: the maximum fine for breaching Art. 13 or Art. 14.

vulnerabilities in CISA's Known Exploited Vulnerabilities catalog (version 2026.10.16). It grows every week.
1,748[2]

vulnerabilities in CISA's Known Exploited Vulnerabilities catalog (version 2026.10.16). It grows every week.

Art. 14 also applies to products placed on the market before 11 Dec 2027, not only new ones.
Every SKU[1]

Art. 14 also applies to products placed on the market before 11 Dec 2027, not only new ones.

How it works

Three steps. No new headcount.

  1. Connect your SBOMs

    Drop in CycloneDX or SPDX JSON, or push from CI on every release. Vigil keeps a live inventory of what ships in every product and firmware version.

  2. It watches what attackers exploit

    Each new CISA KEV entry is checked against every component, with version ranges confirmed on OSV.dev. Name-only matches are flagged, never silently ignored.

  3. You get a verdict and a draft

    Reportable: yes, no, or needs review, with every rule shown. The 24h and 72h deadlines start counting and the early warning text is ready to paste into the SRP.

Live demo

Paste an SBOM. See what is reportable in seconds.

The demo fetches the real CISA KEV catalog server-side, range-checks your components on OSV.dev, and applies deterministic CRA Art. 14 rules.

Run it yourself
  • Live CISA KEV feed, not a snapshot
  • OSV.dev version-range matching for npm, Maven, PyPI, Go and more
  • Transparent yes, no, needs review reasoning
  • Running 24h countdown and copyable early-warning draft

Why now

The window just opened.

  1. 11 Sep 2026

    Art. 14 reporting applies

    Reporting of actively exploited vulnerabilities and severe incidents became mandatory, a year before the rest of the CRA.[1]

  2. 11 Sep 2026

    ENISA's SRP went live

    Notifications go through the Single Reporting Platform to your coordinating CSIRT, simultaneously accessible to ENISA.[3]

  3. Already shipped

    Legacy products count

    Art. 69(3) applies Art. 14 to products placed on the market before 11 Dec 2027. Your installed base is in scope today.[1]

  4. 11 Dec 2027

    Full CRA applies

    Essential requirements, SBOMs and vulnerability handling become mandatory for new products. The same inventory serves both.[1]

Early access

Early access for EU product makers.

We are onboarding a small group of design partners now. Pricing below is planned, not final.

Design partner

Design partners

€0 during the pilot

For manufacturers willing to give weekly feedback.

  • Up to 5 product lines
  • KEV and OSV monitoring
  • Early-warning drafts
  • Direct line to the founder

Founding plan

€390 per month, planned

Locked-in founding price after the pilot.

  • Unlimited SBOMs per product line
  • CI upload and alerts
  • 72h notification and final report drafts
  • Audit trail of every verdict

Prototype: the hosted demo does not store signups; a local install writes them to data/waitlist.json. Nothing is sent to third parties.

FAQ

Straight answers.

Is this legal advice?
No. Vigil is decision support. It applies transparent, deterministic rules and shows its reasoning. A responsible person at your company decides what to submit.
Does Vigil submit to ENISA for me?
Not in this prototype. It drafts the early warning so you can paste it into the ENISA Single Reporting Platform. Submission stays a human action.
Is every KEV entry automatically reportable?
No. The CRA defines an actively exploited vulnerability as one with reliable evidence that a malicious actor exploited it without the system owner's permission.[1] CISA's KEV criteria also include attempted exploitation.[4] KEV is the strongest public signal, and Vigil still asks you to confirm the vulnerable version actually ships.
Who receives the notification?
The CSIRT designated as coordinator in the Member State of your main establishment, via the SRP, simultaneously accessible to ENISA (Art. 14(1) and 14(7)).[1]
What about severe incidents?
Art. 14(3) has the same 24h and 72h structure for severe incidents. Incident workflows are on the roadmap; the demo covers exploited vulnerabilities.
Where does my SBOM go in the demo?
Your browser sends components to the local Next.js server, which queries OSV.dev by package and version and fetches the public KEV feed. Nothing is stored.