The Cyber Resilience Act without a lawyer or a security team.
From 11 September 2026 you must report actively exploited vulnerabilities within 24 hours. From 11 December 2027 no software or connected device can be placed on the EU market without CE marking and security documentation. CRAguard watches your dependencies, hosts your mandatory vulnerability-reporting channel and prepares your self-assessment documentation.
For companies that sell software — not for security departments.
Small software companies
Desktop, mobile, on-prem, libraries, plugins. Anything a customer installs or runs themselves.
Device makers
Anything with firmware or a network connection: IoT, industrial, smart home.
Software agencies
Your clients will ask you for SBOMs and security documentation. Deliver it in a day, not a month.
The first deadline isn't in 2027.
Article 14 reporting also applies to products already on the market. You cannot meet the 24-hour deadline without a process in place.
Reporting from 11 September 2026 applies to products already on the market.
Fines up to €15 million or 2.5 % of turnover — and, more realistically, losing tenders when a buyer asks for documentation.
Harmonised standards aren't out yet — self-assessment is done directly against the regulation.
Watches, hosts, prepares. In that order.
Daily vulnerability watch with a plain-language verdict
Every day we compare your product's components with OSV, CISA KEV and EPSS. Each finding gets one verdict — Fix now, Plan or Informational — and we show you exactly why. Open rules, no black-box score.
A weekly e-mail — even when nothing happened
Every Monday: which products were checked, how many components, what changed, what is still open. "All quiet, 184 components checked" is also a result you can forward to a customer.
Connect GitHub or upload a lock file — first verdict in 5 minutes
We read package-lock.json, packages.lock.json, requirements.txt and other lock files, generate your SBOM (CycloneDX and SPDX) and scan it immediately. No CI pipeline, no security engineer.
Evidence your customers can check themselves
A public trust page at yourcompany.craguard.eu shows SBOM availability, your disclosure channel, advisories and the last scan. One click generates an evidence pack PDF for supplier questionnaires and market surveillance.
Contact: https://vasafirma.craguard.eu/report
Policy: https://vasafirma.craguard.eu/cvd
Three steps. No training.
Upload an SBOM or connect a repository
Syft, Trivy, CycloneDX, SPDX — anything from your build.
CRAguard watches and translates
Turns raw CVEs into a verdict even your CEO understands.
You click the decisions, we write the audit trail
Evidence for the authority and for the buyer who asks.
We check every day. Actively exploited vulnerabilities (CISA KEV) trigger an alert within hours of our sync — and every alert's timeline stays on record.
What CRAguard is not
CRAguard is not legal advice and not a certification. It cannot guarantee completeness or compliance with the regulation. Conformity is declared by the manufacturer. We provide the process and the evidence that back it up.
Priced per product — not per developer, not per SBOM.
Subscriptions from €29/month per product.
- Free — hosted vulnerability disclosure page, security.txt and a one-off SBOM with today's verdicts.
- From €29/product — daily vulnerability watch, plain-language verdicts, weekly status e-mail.
- Higher tiers — multiple products, public trust page and evidence pack PDF. Pricing announced at launch.
Join the waitlist — we'll let you know at launch and send you the first steps towards CRA readiness.
Find out in 2 minutes whether the CRA applies to youFAQ
Does the CRA apply to SaaS?
Mostly not — unless it's cloud functionality necessary for a product to work. SaaS falls under NIS2.
Does it apply to products I already sell?
The reporting obligation from 11 September 2026 does. Full requirements apply on substantial modification or a new placement after 11 December 2027.
Do I have to publish my SBOM?
No — it's part of your technical documentation, provided to the authority on request.
Do I need certification?
Most products are "default" class = self-assessment. Only Annex III/IV categories need a notified body or certification.
I'm just an agency — am I affected?
The manufacturer is whoever places the product on the market under their own name — your client. They'll want the documentation from you.
Key facts
- The Cyber Resilience Act is Regulation (EU) 2024/2847; obligations phase in over time.
- From 11 September 2026: report actively exploited vulnerabilities and severe incidents (24 h / 72 h / 14 days) via ENISA's Single Reporting Platform.
- From 11 December 2027: no product with digital elements on the EU market without CE marking and the Annex I security requirements.
- Penalties up to €15 million or 2.5 % of worldwide annual turnover.
Source: EUR-Lex (Regulation (EU) 2024/2847); European Commission guidance of 27 July 2026.
Find out whether the CRA applies to you
Six questions, two minutes, no account. Get your product class and first steps.