Regulation (EU) 2024/2847 · Article 14 reporting applies from 11 September 2026 — already in force
The CRA’s reporting clock is already running.
Find out in two minutes whether it’s running on you.
Since 11 September 2026, a manufacturer of a product with digital elements sold in the EU has 24 hours to report an actively exploited vulnerability to ENISA — and that includes products shipped years ago. CEMarque tells you whether that is you, gives you the disclosure channel, security contact and security.txt the obligation assumes you already have, and takes you on to the technical file and Declaration of Conformity the next deadline needs — every answer cited to the Article that requires it.
Free, anonymous, about two minutes. No account — you get a permanent verdict link.
Smart home device
- Your role
- ManufacturerF-011
- Classification
- Important, class IF-023
- Conformity route
- Third party, unless harmonised standards are applied in fullF-026
- Article 14 reporting
- Applies from 11 September 2026F-002
- CE marking
- Required from 11 December 2027F-003
A real, public verdict — every line cites the Facts Table, traceable to Regulation (EU) 2024/2847 on EUR-Lex. Guidance, not legal advice: the manufacturer declares.
Two clocks are running on every product in scope.
The Regulation phases in on fixed dates. Where your product stands against each is the first thing a verdict tells you.
From 11 September 2026
Article 14 vulnerability reporting
already in force
Manufacturers must report actively exploited vulnerabilities and severe incidents — early warning within 24 hours of becoming aware. This is in force now, for products already on the market too; the ENISA single reporting platform is open. A product with no disclosure channel and no security contact is a product that finds out from its users.
From 11 December 2027
Full application — CE marking required
in 13 months
Technical documentation, the EU Declaration of Conformity and CE marking, before the product goes on the EU market.
These are two clocks, not one. A product already on the market has reporting duties now and needs CE marking only on substantial modification. Most summaries collapse them and tell you that you are safe until the second date. The checker keeps them apart.
Scope to Declaration, one path.
The CRA is a sequence, and CEMarque walks it in order — each stage produces the artifact the next one needs.
Scope & class
At most 9 questions — or a preset and five confirmations. Scope, class, and conformity route, with citations.
SBOM & checklist
The Annex I essential requirements as a checklist matched to your product type, SBOM attached.
Technical file & DoC
The technical documentation and Declaration of Conformity, generated from what you already answered.
Live for the support period
A hosted security page and Article 14 reporting, maintained for the years you're on the hook.
No paraphrased law. Cited law.
Compliance tools fail when they summarize. CEMarque runs on a versioned Facts Table where every legal claim carries an F-id resolving to the Official Journal text. A sentence that makes a dated or obligation-bearing claim without a citation fails the build and cannot be served at all.
A verdict you can hand to a customer, an auditor, or an AI agent — and every one of them can follow the footnotes to the Regulation itself. Facts Table v2026.09.4 · Rules v2026.09.1 · counter-checked against the Official Journal on 10 September 2026
- Deterministic scope engine — same answers, same verdict, every time. No LLM in the decision path.
- Permanent verdict links with machine-readable exports, equally legible to browsers and AI crawlers.
- When facts or rules change, your saved verdict tells you to re-check — it never silently rots.
- Anonymous by design: no cookies, no account, no raw IP ever stored.
- CEMarque does not certify anything. Nobody can sell you a CE marking; you declare conformity and you sign it. If your product needs a notified body, the checker tells you that and sells you nothing.
- The entire Facts Table is public JSON, and the status page says what is settled and what is not.
Priced for makers, not enterprises.
Start free with the checker. Pay when you need the file that answers the questionnaire on your desk — or the Bulletin that tells you when the Regulation moves.
Attestation Pack
$149 one-time, per product
What Article 14 assumes you already have, plus the answer to the questionnaire on your desk.
| Pack | $149 one-time |
| Pack + Watch Bulletin | $149 + $19/mo after the included 3 months |
| Pack + 12 months hosted-page maintenance | $290 one-time |
Watch Bulletin
$29 per month, per organisation
When the Regulation moves, you hear about it — with the Article behind it.
Subscribe — $29 a monthSecure checkout on StripeProduct plan
From $49 per month, banded by how many products you run
The running process the Regulation actually asks for.
| 1 product | $49/mo |
| Up to 5 products | $99/mo |
| Up to 20 products | $249/mo |
Agency
$299 per month, 10 products, then $15 each
For people carrying this for other people's products.
Join the Agency waitlistOpens after the Pack — join the waitlistThe Attestation Pack and the Watch Bulletin are on sale now — checkout is on Stripe, and the refund policy is fourteen days, no reason required. The Product and Agency plans are on sale too; you start them from your CEMarque account. The scope checker, verdict permalinks, and the facts corpus are free and stay free. What is in each, and the questions people ask →
Before you start.
Is this legal advice?
No, and it never claims to be. CEMarque encodes the published text of Regulation (EU) 2024/2847 and shows you the Article behind every statement so you can check it yourself. Where the stakes justify it, take the output to counsel — it will cost you less to review something than to have it drafted.
Does CEMarque certify my product?
No. CEMarque prepares the documentation; you declare conformity and you sign the declaration. Nobody can sell you a CE marking, and anyone who implies otherwise is worth walking away from.
How do I buy, and how do I cancel?
Checkout is a Stripe page: you enter your business details, accept the Terms of Service, and pay in US dollars; the receipt comes from Stripe. The Bulletin renews monthly. To cancel, open the customer portal linked on this page and on every Bulletin — the subscription ends at the end of the paid month and there is no retention flow. Refunds follow the Refund and Cancellation Policy: fourteen days on the Pack after delivery and on the first Bulletin payment, no reason required.
My product is important class II or critical. Can I use this?
Not for conformity assessment. Those classes require a notified body, the checker says so plainly, and there is no plan call to action on that result. The free checker is still useful for establishing which class you are in and why.
What if the law changes?
The Facts Table is versioned and every verdict is stamped with the version that produced it. When the table is updated, verdicts made under an older version show a re-check banner, and affected corpus pages carry a dated change note.
What happens if I stop paying?
Your documents remain yours and stay retrievable. The Regulation requires the technical file and declaration to be kept for at least ten years after placing on the market, or the support period if longer, so holding your compliance evidence hostage to a subscription would be indefensible.
Can I get help paying for this?
Possibly. The EU SECURE programme co-funds micro, small and medium enterprises for CRA readiness, up to EUR 30,000. Ask your national contact point whether a call is open — the amounts involved dwarf what this costs.
Why is the checker free?
Because the answer to "does this apply to me?" should not cost anything, and because a corpus that search engines and AI assistants quote accurately is worth more to us than the few dollars a scope check would earn.
Find out where you stand before the deadline does.
Two minutes, 9 questions at most, and a cited verdict you can send to anyone who asks.
Check your product’s scope →CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 10 September 2026 (Facts v2026.09.4). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.