EU Cyber Resilience Act · Software & Consulting

We help manufacturers comply with the EU Cyber Resilience Act.

We build software for SBOM management, vulnerability monitoring, and CRA reporting. We also provide regulatory and cybersecurity consulting. Most clients use both. Some do not. Either way, we can help.

Free CRA diagnostic Talk to us → How the CRA affects you
€15M
Maximum fine
24h
Incident reporting deadline
Dec. 2027
CRA fully applies
EU
Software & consulting
Regulatory framework

The CRA is in effect. Deadlines are approaching.

The EU Cyber Resilience Act requires manufacturers of digital products to meet cybersecurity, documentation, and reporting obligations. It carries significant penalties for non-compliance.

December 2024

Entry into force

The regulation became EU law. All manufacturers of products with digital elements should have started their compliance work.

September 2026

Reporting obligations begin

Manufacturers must report actively exploited vulnerabilities and severe incidents. Early warning within 24 hours of awareness. Via the EU Single Reporting Platform.

December 2027

Full compliance required

Products on the EU market must meet cybersecurity, conformity assessment, technical documentation, and CE marking requirements.

About us

Software engineers, cybersecurity specialists, EU regulatory lawyers. All under one roof.

We are a European team. We built a software platform that handles the technical side of CRA compliance: SBOM ingestion, vulnerability correlation, reporting. And we have the lawyers and security engineers to do the work that software cannot do.

Most of our clients use both. They run their compliance programme on our platform, and they call us when they need a regulatory opinion, a document drafted, or help preparing for an audit.

🇪🇺

Based in Europe

Our team works from France and Germany. Our infrastructure runs on OVHcloud and Scaleway. Data stays in the EU because that is where we live and work.

⚡

We built the tools we use

Our platform ingests SBOMs, correlates CVEs, tracks evidence, and manages the Article 14 reporting process. We built it because we needed it for our consulting work.

🎯

We do the work software cannot

Interpreting the regulation. Drafting your Declaration of Conformity. Dealing with notified bodies. Preparing audit evidence. Our lawyers and engineers handle this.

🧑‍⚖️

One point of contact

You work with one team for everything. You do not coordinate between a tool vendor and a separate consultant.

What we do

Software. Consulting. Most clients need both.

We help with every part of CRA compliance. Use our software on its own. Bring us in for specific projects. Or combine both — that is what most clients do.

SOFTWARE

CRA Compliance Software

Our platform handles SBOM management, vulnerability monitoring, evidence tracking, and Article 14 reporting. Multi-product. Hosted in the EU.

SBOM managementCVE monitoringMulti-productEU-hosted

CRA Readiness Assessment

We review your product portfolio against CRA requirements. Product classification, gap analysis, prioritised action plan. Usually takes two weeks.

Gap analysisFull CRA coveragePrioritised actions

Vulnerability & Incident Response

CVE monitoring and triage against your products. VEX preparation. Article 14 reporting process — our platform flags, our team reviews.

24h triageHuman-reviewedSRP-ready

Technical Documentation & CE Marking

Annex VII documentation, Declaration of Conformity, CE marking files. Drafted by our consultants, reviewed by our regulatory lawyers.

Annex I & VIIDoC draftingLawyer-reviewed

SBOM & Supply Chain

SBOM ingestion, validation, and monitoring. CycloneDX and SPDX. Dependencies mapped to CVEs. Evidence preserved for audit.

CVE correlationDependency trackingAudit evidence

Advisory & Training

CRA workshops for engineering and compliance teams. NIS2 overlap analysis. Regulatory opinions. Answers from real experts, not a search engine.

Team trainingAudit evidenceLawyer-reviewed
Infrastructure

Built on European infrastructure

OVHcloud and Scaleway for hosting. Mistral AI for AI workloads. Zitadel for identity management. Each chosen because they operate under EU law.

Scaleway

Cloud

Mistral AI

AI

OVHcloud

Hosting

Zitadel

Identity

FAQ

CRA compliance — questions you probably have

The Cyber Resilience Act is EU regulation 2024/2847. It sets mandatory cybersecurity requirements for products with digital elements sold on the European market. It covers design, development, vulnerability handling, and incident reporting.

If you manufacture, import, or distribute products with digital elements on the EU market, the CRA applies to you. This includes software, hardware, SaaS, IoT devices, and mobile apps. It does not matter where your company is based.

The CRA entered into force on 10 December 2024. Article 14 reporting obligations apply from 11 September 2026. Full compliance — including conformity assessment and CE marking — is required from 11 December 2027.

A Software Bill of Materials is a machine-readable inventory of your software components and dependencies. Under the CRA, you need to know what is in your product to manage vulnerabilities and provide evidence to auditors. Yes, you need one.

CRA evidence includes sensitive vulnerability and product data. Hosting in the EU keeps that data under EU data protection law and meets the expectations of European customers and regulators.

It depends on your products, their classification, and your current maturity. A readiness assessment usually takes two weeks and gives you a clear picture of the scope, the gaps, and the timeline.

Contact

Tell us what you need

Describe your products and where you stand with the CRA. We will give you an honest assessment of what would help — software, consulting, or both.

✅Response within 24 business hours
✅Confidential, no obligation
✅Europe-based team
✅Free initial diagnostic