EU Cyber Resilience Act, Article 14

When a flaw in your product is exploited, you have 24 hours to tell ENISA.

Since 11 September 2026, every maker of connected products sold in the EU must report. Check whether researchers and regulators can reach you today.

1 of 24

Most IoT brands are hard to reach about a security flaw.

A security.txt file tells researchers who to contact when they find a flaw in your product. In October 2026 we checked 24 well-known smart-home and IoT brands sold in the EU. Only 1 had it set up correctly, and 15 had none at all.

How we can help

Full details and FAQ

Readiness Pack

5 working days, start to drill

  • Researchers know exactly how to reach you
  • Every report lands with someone who knows what to do next
  • Your team can file ENISA's 24-hour report in minutes, not a day
  • You've rehearsed it once, before it's real
Get started

On-call retainer

4 h acknowledgement, 7 days a week

  • Never miss a 24-hour deadline, weekends included
  • No security inbox for your team to watch
  • We triage reports and file every ENISA report for you
  • We flag new flaws in the parts you ship
Get started
security.txt generatorA security.txt and disclosure policy, drafted in your browser. 24h / 72h / 14-day runbookWho does what at each deadline, printable. Plain-language CRA guidesReporting, ENISA's platform, PSIRT setup, SBOMs and the timeline.