Customers started asking about the CRA
Procurement checklists now include Cyber Resilience Act questions, and the answers are not ready.
CRA readiness
The Cyber Resilience Act, worked out for each part of your product
We work out which parts of your product the Cyber Resilience Act covers, compare how you build, update and support them with what the regulation requires, and give you the gaps and a plan that fits your release cycle. If you want, we close them with you, and keep the result current afterwards.
- Product scope
- Vulnerability handling
- SBOM
Manufacturers of products sold in the EU, including software
- Applies to
- Manufacturers of products with digital elements sold in the EU, including software. Pure services fall outside it
- What it asks for
- Security built into the product, vulnerability handling, updates for a defined support period, and reporting of exploited vulnerabilities
- In force
- Reporting since 11 September 2026; the rest from 11 December 2027
- Who checks
- Market surveillance authorities, with fines up to €15 million or 2.5% of worldwide turnover
The CRA does not issue a certificate the way ISO 27001 does. Most products are self-assessed by the manufacturer before the CE marking goes on; some categories need an outside body.
Which parts are covered, then what is missing
Scope
The product architecture mapped to the regulation, component by component, and what is already in place.
Gap assessment
Secure development, dependency management, update delivery, vulnerability handling and the reporting obligations already in force, compared with how things actually run.
Plan
Gaps ordered by deadline and effort, with an owner for each, fitted to your release cycle.
Closing the gaps
Your team closes them, or we work alongside, or we take them on: SBOMs produced, a support period defined, a vulnerability handling and reporting process set up.
Keeping it current
Periodic check-ins as releases go out and the December 2027 deadline approaches.
A product with three parts
ResultScope settled, a reporting process in place, and a roadmap that fits the release cycle.A software vendor unsure what the CRA coversRead the engagement
Its platform had a cloud service, a desktop client and an on-premise agent, each of which could fall differently under the regulation. We separated the parts that count as products from the pure service, then assessed those parts. We found no SBOM, vulnerable open-source components in the agent, no defined support period for older client versions, and a security contact address nobody monitored. The company now answers customers' CRA questions, has a reporting process in place, and has a roadmap that fits its release cycle.