I’m Maxime, founder and builder of the Clearlane apps for Jira and Confluence. Today I’d like to tell you about one of them: Clearlane CRA.
The Cyber Resilience Act entered into force in December 2024, and it passed an important milestone last month. Since 11 September 2026, a manufacturer has to send an early warning within 24 hours of becoming aware of an actively exploited vulnerability in its product, and of any severe incident affecting its security. The warning goes to the CSIRT designated as coordinator in its country and to ENISA, through ENISA’s single reporting platform. A fuller notification follows within 72 hours, then a final report: within 14 days of a fix being available for a vulnerability, or within one month for an incident. From 11 December 2027 the rest of the regulation applies, and products that don’t meet it can no longer be placed on the EU market.
But you’re responsible professionals, so you already know all this. And you also know how important this is.
What you may not have worked out yet is how to react as efficiently as possible while keeping to those deadlines. A hint: you already use Jira. That’s exactly why I thought a very simple tool belonged inside Jira: an app whose fields are prepared with the ENISA platform’s own labels and length limits, that lets you import your SBOMs easily (CycloneDX or SPDX JSON, one per product version), record the security update, inform your users, and publish a security advisory with a CSAF 2.0 file built from the case. It also keeps a register of all your cases.
At any time, for example when you close a case, one click builds a PDF evidence file that brings together the facts, the decisions, the reports, the fix, the user notice, the advisory and the signatures (each with its SHA-256 fingerprint), which you can download or attach to the Jira work item. Article 13(13) asks the manufacturer to keep this kind of record with the technical documentation for at least ten years, or for the support period if that is longer, and Jira keeps the PDF on the work item even without the app.
To top it off, the app includes a Rovo agent (where Rovo is enabled), follows each person’s Jira language (English, French or German; the ENISA fields stay in English, like the platform), and even follows your light or dark theme, because I like that kind of detail.
One word of caution, though. The app is a thorough aid for meeting the CRA’s reporting and vulnerability-handling requirements, but it remains a tool. Deciding whether a vulnerability is actively exploited, and submitting each report on the ENISA platform, stay with you, and so does the responsibility.
If you’re subject to the CRA and your team already works in Jira, Clearlane CRA is on the Atlassian Marketplace:
https://marketplace.atlassian.com/apps/1921641504
Maxime
