CRA-compliant,
with no blind spots.

Q: What are the exact deadlines?

Two dates. On 11 September 2026, reporting actively exploited vulnerabilities becomes mandatory (Article 14). On 11 December 2027, the full set of requirements applies, including the sanctions regime: up to €15M or 2.5% of worldwide turnover (Article 64).

Q: What is an SBOM, and how do I get one to you?

The Software Bill of Materials is the inventory of components — libraries, dependencies, versions — that make up your product. The CRA requires it in your technical documentation. Probenta generates it from your build pipeline, or takes an existing SBOM in the standard formats (CycloneDX, SPDX).

Q: How do I prove I notified on time?

Every action is written to an append-only log: entries are time-stamped and chained to one another, so none can be altered or removed after the fact. That log is what you present to the supervisory authority to demonstrate the notification went out on time.

Probenta watches your products, fires your regulatory notifications within the deadline and keeps your audit file ready to show.

Start the CRA self-assessment

Free, about 5 minutes. Your answers stay in your browser until you request your report — privacy.

Regulatory calendar — Regulation (EU) 2024/2847

Today

There are days left before the first deadline.

11 Sept 2026Mandatory reporting of exploited vulnerabilitiesArticle 1411 Dec 2027Full compliance and sanctions regimeArticles 64 and 71

Pick a deadline to see what it requires.

11 Sept 2026

Article 14

Mandatory reporting of exploited vulnerabilities

As soon as a vulnerability in your product is actively exploited, a legal clock starts. Three deadlines follow, filed on ENISA's single reporting platform.

24 h

Early warning

Report the actively exploited vulnerability, without waiting for the analysis to be complete.

72 h

Full notification

Nature of the vulnerability, nature of the exploitation, corrective measures under way.

14 d

Final report

Once a fix is available: root cause, impact, measures taken.

“A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements […]”
— Regulation (EU) 2024/2847, Article 14

11 Dec 2027

Articles 64 and 71

Full compliance and sanctions regime

The regulation applies in full. Without a compliant file, the CE marking no longer holds — and the sanctions regime becomes enforceable.

€15M

Maximum fines

Or 2.5% of total worldwide annual turnover, whichever is higher.

Markets closed

Without a compliant CE marking, no placing on the market in the Union.

Annex VII

Technical documentation

The file must exist, be kept up to date and be available on request.

Non-compliance with the essential requirements of Annex I and the obligations of Articles 13 and 14 is subject to administrative fines of up to €15,000,000 or, for an undertaking, 2.5% of its total worldwide annual turnover, whichever is higher.

Feeds and sources monitored

CISA KEV · CERT-FR · ENISA (EUVD) · NVD

What the CRA requires

The clock is ticking, you'll be notified in time

An exploited vulnerability starts a legal countdown. Miss it, and it is a sanction.

The technical file is a time sink.

Documentation, analyses, evidence: hours of engineering work, continuously.

Proving you notified on time.

Without a tamper-proof log, compliance cannot be demonstrated.

What you see the day a CVE lands

Six screens from the application, in the order you walk through them: the SBOM uploaded, the vulnerability correlated, the qualification that starts the three Article 14 deadlines, the filing pre-filled, the submission recorded, the evidence exported. Fictional data, real screens.

Demo · fictional data

Probentapsirt@arvia-networks.euSign out

Products

The product repository (PDE) — create a product and issue its ingestion token.

Create a product

Products
Name	Version	CRA classification	Status	Last SBOM	Created on
Arvia Gateway	4.2.1	Important — class II	Active	no SBOM	02/09/2026
Arvia VPN Client	3.8.0	Important — class I	Active	3 d ago · SBOM parsed	02/09/2026
Arvia SIEM Collector	2.5.4	Important — class I	Active	5 d ago · SBOM parsed	04/09/2026
Arvia Console	1.9.2	Default	Active	no SBOM	08/09/2026

← Products

Arvia Gateway

SBOM (Software Bill of Materials) — upload a CycloneDX or SPDX JSON document for this product.

SBOM file (.json)

Choose a file arvia-gateway-4.2.1.cdx.json

Accepted formats: CycloneDX or SPDX, in JSON · 20 MB maximum.

UploadUploading…Upload

SBOM imports

SBOM imports
Format	Received on	Status	Rejection reason
CycloneDX (JSON)	15 Sep 2026, 09:12	SBOM receivedSBOM parsed	—

No SBOM import for this product.

Common components

Common components
Name	Version	purl	Licenses
quic-go	0.48.2	pkg:golang/github.com/quic-go/quic-go@0.48.2	MIT
ws	8.17.0	pkg:npm/ws@8.17.0	MIT

No components — no SBOM import analysed yet.

A CycloneDX or SPDX document is all it takes: Probenta derives the list of your components and their versions. No source code is ingested.

Probentapsirt@arvia-networks.euSign out

Vulnerabilities

Vulnerabilities detected through SBOM correlation — actively exploited cases (KEV) appear first.

0 actively exploited1 actively exploited0 to qualify1 to qualify2 to qualify0 qualified0 dismissed

Detected vulnerabilities
Vulnerability	Product	Components	Status	Detected on	Actions
CVE-2026-48119Active exploitation (KEV)	Arvia Gateway	quic-go@0.48.2	To qualify	15 Sep 2026, 09:14	QualifyDismiss… 5/7 pre-filled
CVE-2026-47330	Arvia VPN Client	ws@8.17.0	To qualify	15 Sep 2026, 09:14	QualifyDismiss… 0/7 pre-filled

No vulnerability detected — correlations will appear here.

A scanner lists CVEs. Article 14 only requires you to notify an actively exploited vulnerability: Probenta flags the ones listed in the KEV catalogue, so you don't have to look for them.

Probentapsirt@arvia-networks.euSign out

Vulnerabilities

Vulnerabilities detected through SBOM correlation — actively exploited cases (KEV) appear first.

1 actively exploited2 to qualify1 to qualify0 qualified1 qualified0 dismissed

Detected vulnerabilities
Vulnerability	Product	Components	Status	Detected on	Actions
CVE-2026-48119Active exploitation (KEV)	Arvia Gateway	quic-go@0.48.2	To qualifyQualified	15 Sep 2026, 09:14	QualifyDismiss… 5/7 pre-filled View the notification
CVE-2026-47330	Arvia VPN Client	ws@8.17.0	To qualify	15 Sep 2026, 09:14	QualifyDismiss… 0/7 pre-filled

Regulatory-reach action

Qualify “CVE-2026-48119 — Arvia Gateway”?

This qualification arms the internal clock: the following 3 deadlines will start.

24 h — first notification: 16 Sep 2026, 09:31
72 h — full notification: 18 Sep 2026, 09:31
Final report: 14 days after the corrective measure is available

Irreversible while the clock is running: every step is logged in the audit trail.

CancelQualify and start the deadlines

The decision stays human; the timestamp does not. The moment you qualify, the three Article 14 deadlines are computed — 24 h, 72 h, final report — and the action is logged.

Probentapsirt@arvia-networks.euSign out

← Notification

ENISA declaration

Review, complete, copy. Submission happens on the ENISA platform — Probenta doesn't submit anything on your behalf.

Arvia Gateway · CVE-2026-48119

Not submitted

Early warning (24 h)

5/7 required6/7 required7/7 required

Not submitted

Notification (72 h)

0/1 required

Not submitted

Final report

0/4 required

To the right of each label: the exact field name on the ENISA form.

Notification

Notification type (vulnerability | incident)Notification type (Vulnerability/Incident)RequiredPre-filled

VulnerabilityCopy

Notification titleTitleRequired

Remote code execution via quic-go in Arvia Gateway 4.2.1

SummarySummaryRequired

quic-go 0.48.2, bundled in Arvia Gateway 4.2.1, is being actively exploited (KEV catalogue). A fix is under qualification; customers are advised to restrict exposure of the QUIC port.

Manufacturer

Manufacturer / steward (legal name)Manufacturer nameRequiredPre-filled

Arvia Networks SASCopy

Member States where the product is availableMember States where product available (Concerned CSIRT)RequiredPre-filled

FR, DE, NL, BECopy

Product

Product (PDE)Product NameRequiredPre-filled

Arvia GatewayCopy

Product versionProduct versionRequiredPre-filled

4.2.1Copy

Affected componentComponent nameOptionalPre-filled

quic-go@0.48.2Copy

Identifiers

CVE identifierCVE IDOptionalPre-filled

CVE-2026-48119Copy

EUVD identifierEUVD IDOptionalPre-filled

EUVD-2026-19042Copy

Everything is saved · 5/7 required6/7 required7/7 required

All fields of this step have been copied

Copy the step (review)CopiedOpen the ENISA platformMark as submitted

ENISA's form is already filled with what Probenta knows: notification type, manufacturer, product, version, component, CVE. What remains is the judgement fields — the title and summary at 24 h, five more at 72 h — to review, then copy onto the platform.

Probentapsirt@arvia-networks.euSign out

Notifications

Armed internal clocks and their schedule — the 3 deadlines (24 h, 72 h, final report) at a glance.

0 overdue2 in progress1 closed

Armed notifications
Notification	State	Early warning — 24 h	Notification — 72 h	Final report
Arvia SIEM CollectorCVE-2026-41862	24h submitted	Submitted12 Sep 2026, 16:02	2 h15 Sep 2026, 14:30	Awaiting corrective measure
Arvia GatewayCVE-2026-48119	Armed	21 h16 Sep 2026, 09:31	D-2 21 h18 Sep 2026, 09:31	Awaiting corrective measure
Arvia VPN ClientCVE-2026-44207	Closed	Submitted10 Sep 2026, 07:40	Submitted11 Sep 2026, 18:20	Submitted14 Sep 2026, 10:05

← Notifications

Arvia Gateway — CVE-2026-48119

Armed24h submittedSRP: SRP-FR-2026-0093118ENISA declarationExport the evidence PDF

Submission is done manually on the ENISA platform (SRP): the application tracks your deadlines and evidence, it submits nothing on your behalf.

Mark the 24-hour early warning as submitted

Early warning (24 h)

21 h

Deadline · 16 Sep 2026, 09:31

Early warning (24 h)

Submitted

Submitted on 15 Sep 2026, 11:47

Notification (72 h)

D-2 21 h

Deadline · 18 Sep 2026, 09:31

Final report

Awaiting corrective measure

ENISA's platform offers no machine interface: filing there is a human action, for everyone. Probenta keeps the schedule, records the filing identifier and turns it into dated evidence.

Probentapsirt@arvia-networks.euSign out

Audit log

The tenant's last 500 append-only chain events.

From15/09/2026To15/09/2026Filter

Audit log
Seq.	Timestamp	Event	Entity	Actor
1,048	15 Sep 2026, 11:47	SRP identifier recordednotification_srp_identifier_updated	notification	User · a3f19c04…
1,047	15 Sep 2026, 11:47	24-hour early warning marked submittedmark_24h_submitted	5c81f3a2…	User · a3f19c04…
1,046	15 Sep 2026, 09:31	Internal clock armednotification_armed	notification	System
1,045	15 Sep 2026, 09:31	Vulnerability qualifiedfinding_qualified	finding 9b…	User · a3f19c04…
1,044	15 Sep 2026, 09:14	Vulnerability detectedfinding_detected	finding 9b…	System
1,043	15 Sep 2026, 09:12	SBOM parsedsbom_parsed	sbom_upload	System
1,042	15 Sep 2026, 09:12	SBOM receivedsbom_received	sbom_upload	API token · 7d2e5b81…

The seven rows above are exactly what you just watched, in order, timestamped, with the author of each action. This is what you export when you are asked to prove the timeline.

These six screens only matter if your product falls within the scope of the CRA.

Check whether my product is in scope

Free, about 5 minutes.

A mapping of your obligations, an evidence register.

A mapping of your obligations, an evidence register kept current.

01 — MAPPING

Your obligations, translated

Every CRA requirement becomes a traceable obligation, mapped to your products.

02 — EVIDENCE

A file that is always ready

Everything is centralized and versioned. The audit file exports in one click.

03 — MONITORING

The regulation moves, you keep up

You are alerted as soon as a regulatory change affects your scope.

04 — STEERING

Who delivers what, and by when

A dashboard per product and per milestone. Everyone knows what to deliver, and when.

Core of the product

Article 14 alarm

The full chain, from detection to proof of notification.

01 · CORRELATION

Your components, cross-checked against actively exploited vulnerabilities

02 · CLOCK

24 h / 72 h / 14 d, armed in one click on qualification

03 · NOTIFICATION

Pre-filled in the format ENISA publishes

04 · PROOF

Notification within the deadline, demonstrable

Included

Continuous monitoring

Your portfolio is continuously checked against exploited vulnerabilities.

Coming soon

Annex VII technical file

Generated and kept up to date automatically.

Coming soon

Hosted disclosure portal

Your reporting page, turnkey.

We never ingest your source code.

Your component inventory is all we need. Nothing else leaves your systems.

SBOM + metadata only

Hosted in the EU

Append-only audit log

GDPR compliant

Compliance

Our processors are European

Hosting, emailing, processors: our entire chain is European and GDPR compliant.

01 · HostingFrance

Scaleway

French cloud provider, ISO 27001 certified.

Scaleway security & certifications →

02 · EmailingFrance

Brevo

A French company. Your data stays in the EU.

Brevo & the GDPR →

03 · AnalyticsEU

Plausible

Site statistics with no cookies and no personal data, hosted in the EU.

Plausible & privacy →

04 · ProcessingEU

GDPR end to end

Data minimisation, EU hosting, rights you can exercise at any time.

Read Regulation (EU) 2016/679 →

The details of our processing activities are in our privacy policy.

The CRA, and Probenta, in detail

What the regulation demands and how the product works.

What is the Cyber Resilience Act, and does it cover my product?

Regulation (EU) 2024/2847 sets cybersecurity requirements for every product with digital elements placed on the European market: software, connected devices, embedded components. If your product connects to a network, directly or indirectly, it is very likely in scope. Read the regulation →

What are the exact deadlines?

Two dates. On 11 September 2026, reporting actively exploited vulnerabilities becomes mandatory (Article 14). On 11 December 2027, the full set of requirements applies, including the sanctions regime: up to €15M or 2.5% of worldwide turnover (Article 64).

What is an SBOM, and how do I get one to you?

The Software Bill of Materials is the inventory of components — libraries, dependencies, versions — that make up your product. The CRA requires it in your technical documentation. Probenta generates it from your build pipeline, or takes an existing SBOM in the standard formats (CycloneDX, SPDX).

How do you detect the vulnerabilities that actually affect me?

We continuously cross-check your SBOM against catalogues of actively exploited vulnerabilities, notably CISA's KEV catalog and CERT-FR advisories. Only a vulnerability that genuinely touches a component in your portfolio raises an alert. We orchestrate proven open-source tools rather than an opaque proprietary engine.

What goes into an Article 14 notification?

Article 14 sets three deadlines. Two run from the moment you become aware of the actively exploited vulnerability: an early warning within 24 h, then a detailed notification within 72 h. The third starts elsewhere: the final report is due within 14 days after a corrective or mitigating measure becomes available — and within one month of the notification where a severe incident is concerned. These go to the coordinating CSIRT and ENISA. ENISA provides no machine interface: filing remains a human action on its form. Probenta arms the clock as soon as you qualify the alert and pre-fills what can be pre-filled; the fields that carry a judgement remain yours, prepared in advance rather than discovered against the clock.

How do I prove I notified on time?

Every action is written to an append-only log: entries are time-stamped and chained to one another, so none can be altered or removed after the fact. That log is what you present to the supervisory authority to demonstrate the notification went out on time.

What is the Annex VII technical file?

It is the documentation you must be able to produce at any time: product description, cybersecurity risk assessment, SBOM and components, vulnerability handling, support period. Probenta generates it from data you have already entered and keeps it current, rather than having you reconstruct a file the night before the audit.

Do you access my source code?

Never. Probenta processes only your SBOM and product metadata. Your code stays with you. This is an architectural choice: the less sensitive data we hold, the smaller your attack surface — and ours.

Where is my data hosted?

In France, on Scaleway, a French cloud provider certified ISO 27001. Our e-mails go through Brevo (Sendinblue SAS), also a French company. No data leaves the European Union. The details are in our privacy policy.

What is the real risk of non-compliance?

Two levels. The first is financial: up to €15M or 2.5% of worldwide turnover for failing the essential requirements. The second is commercial, and often heavier: without compliant CE marking, the product can no longer be placed on the European market.

A regulatory engineer, a security engineer

We combine regulatory expertise and software engineering to make the CRA manageable.

Ayoub Tougani

Software engineer and regulatory expert

Years in regulatory affairs and healthcare, now put to work automating compliance processes.

Alexandre Berthiot

Software and cybersecurity engineer

Seven years in healthcare, where product compliance is not negotiable, and a background in defensive security (blue team).

Let's talk about your deadline.

A quick conversation is enough to see where you stand. We get back to you within 72 business hours.

E-mail

Write to us

Based in

Nancy - France

Waitlist

No spam. We'll write when we open. By subscribing you agree we keep your information for this sole purpose — privacy.