Reviewed 17 August 2026
CRA deadline calculator
Put in the moment you became aware and get the two hard deadlines plus an indicative planning marker for the final report. Everything is computed in your browser; nothing is transmitted or stored.
Last updated · Written and reviewed by Jonatan Tensetti · Tensetti Tools
Enter an awareness time to see the deadlines.
How to read the result
The 24-hour and 72-hour deadlines run from the moment of awareness, so they are simple arithmetic once you have fixed that moment. The final report is different: for an actively exploited vulnerability it follows the availability of a corrective or security update, and for a severe incident it follows the point at which the incident is handled. The marker above is a planning aid to keep the item on someone's calendar — it is not a legal due date, and you should replace it with the real trigger as soon as you know it.
Fix the awareness moment before you calculate anything
The most common failure is not a missed hour, it is a disputed start. Write down, in advance, which signals count as awareness — a CSIRT notification, a researcher email landing in the monitored inbox, telemetry crossing a threshold, a customer report reaching support — and where the timestamp is recorded. Record the moment in UTC as well as local time; incident bridges cross time zones and daylight saving changes.
Weekends and public holidays do not pause the clock
Twenty-four hours means twenty-four hours. If your rota cannot produce an approved early warning on a Sunday morning, that is a staffing decision to make now, not a discovery to make later. Name a deputy with the same platform access and the same authority to send.
Full detail on each stage is on the reporting deadlines page, and the fields each stage expects are on the Article 14 checklist. This calculator is a preparation aid, not legal advice, and never a reporting channel.
Reviewed 17 August 2026 · assessment version 1.0.0