CRA reporting obligations apply since 11 September 2026
If you sell software or connected hardware in the EU, you must report actively exploited vulnerabilities to ENISA within 24 hours. ShipAttest watches every component you ship, starts the clock, tells you whether you're affected, and drafts the reports.
- uses: shipattest/action@v1
with:
product: smart-hub
version: ${{ github.ref_name }}
token: ${{ secrets.SHIPATTEST_TOKEN }}The free CLI reads your lockfiles or an existing SBOM and uploads a CycloneDX bill of materials for every release.
Each day, every component is re-checked against OSV, CISA's Known Exploited Vulnerabilities catalogue and ENISA's EU Vulnerability Database.
When a shipped component becomes actively exploited, the clock starts, AI triage tells you if you are affected, and the ENISA reports are drafted.
Article 14 obligations start the moment you become aware. We tell owners and admins immediately, with the deadline in the subject line.
Claude reads the advisory and how your code imports the package, then suggests affected / not affected with a VEX justification for a person to confirm.
Drafts follow what ENISA's single reporting platform asks for, built only from facts you hold, with gaps clearly marked.
CycloneDX 1.6 SBOMs per release and VEX documents recording why each finding does or doesn't affect you.
Annex VII technical documentation, the EU declaration of conformity, user information, a CVD policy and security.txt.
Every upload, decision and submission is time-stamped, so you can show a regulator when you knew and what you did.
The CLI is free forever. Pay when you want monitoring, reports and documentation.
For open-source projects and a first look.
$0
For teams shipping products into the EU.
$199 per product / month
For manufacturers with a product portfolio.
$1,500 / month