From the April 2026 rules, a high-risk or critical update that is not applied within 14 days of release is an automatic Cyber Essentials fail. Enter the release date and we work out your exact deadline, and tell you whether you are assessed under the old Willow rules or the new Danzell ones.
Work out your patch deadline and question set
The vendor release date for the high-risk or critical fix.
This decides whether Willow or Danzell rules apply.
The 14-day rule covers high-risk and critical updates only, across operating systems, router and firewall firmware, applications and their extensions. It is one of the automatic-fail conditions under the 2026 Danzell question set.