# The Cyber Resilience Act without a lawyer or a security team. Canonical: https://craguard.eu/ Language: en Last updated: 2026-09-02 Regulation (EU) 2024/2847 · Cyber Resilience Act From 11 September 2026 you must report actively exploited vulnerabilities within 24 hours. From 11 December 2027 no software or connected device can be placed on the EU market without CE marking and security documentation. CRAguard watches your dependencies, hosts your mandatory vulnerability-reporting channel and prepares your self-assessment documentation. [Find out in 2 minutes whether the CRA applies to you](https://craguard.eu/checker)[Join the waitlist](https://craguard.eu/#waitlist) Verdicts in plain language Weekly status e-mail First verdict in 5 minutes Reporting obligation · Art. 14 11 Sep 2026 in 4 days Full conformity + CE 11 Dec 2027 in 460 days Who it's for ## For companies that sell software — not for security departments. ### Small software companies Desktop, mobile, on-prem, libraries, plugins. Anything a customer installs or runs themselves. ### Device makers Anything with firmware or a network connection: IoT, industrial, smart home. ### Software agencies Your clients will ask you for SBOMs and security documentation. Deliver it in a day, not a month. Why now ## The first deadline isn't in 2027. Article 14 reporting also applies to products already on the market. You cannot meet the 24-hour deadline without a process in place. 01 Reporting from 11 September 2026 applies to products already on the market. 02 Fines up to €15 million or 2.5 % of turnover — and, more realistically, losing tenders when a buyer asks for documentation. 03 Harmonised standards aren't out yet — self-assessment is done directly against the regulation. What CRAguard does ## Watches, hosts, prepares. In that order. Daily ### Daily vulnerability watch with a plain-language verdict Every day we compare your product's components with OSV, CISA KEV and EPSS. Each finding gets one verdict — Fix now, Plan or Informational — and we show you exactly why. Open rules, no black-box score. Fix today CVE-2026-31337 · in KEV Schedule 2 findings · EPSS 0.12 For your information doesn't affect your version Monday ### A weekly e-mail — even when nothing happened Every Monday: which products were checked, how many components, what changed, what is still open. "All quiet, 184 components checked" is also a result you can forward to a customer. 5 minutes ### Connect GitHub or upload a lock file — first verdict in 5 minutes We read package-lock.json, packages.lock.json, requirements.txt and other lock files, generate your SBOM (CycloneDX and SPDX) and scan it immediately. No CI pipeline, no security engineer. Trust page ### Evidence your customers can check themselves A public trust page at yourcompany.craguard.eu shows SBOM availability, your disclosure channel, advisories and the last scan. One click generates an evidence pack PDF for supplier questionnaires and market surveillance. # /.well-known/security.txt Contact: https://vasafirma.craguard.eu/report Policy: https://vasafirma.craguard.eu/cvd How it works ## Three steps. No training. 1 ### Upload an SBOM or connect a repository Syft, Trivy, CycloneDX, SPDX — anything from your build. 2 ### CRAguard watches and translates Turns raw CVEs into a verdict even your CEO understands. 3 ### You click the decisions, we write the audit trail Evidence for the authority and for the buyer who asks. We check every day. Actively exploited vulnerabilities (CISA KEV) trigger an alert within hours of our sync — and every alert's timeline stays on record. Straight talk ## What CRAguard is not CRAguard is not legal advice and not a certification. It cannot guarantee completeness or compliance with the regulation. Conformity is declared by the manufacturer. We provide the process and the evidence that back it up. Pricing Priced per product — not per developer, not per SBOM. ## Subscriptions from €29/month per product. - Free — hosted vulnerability disclosure page, security.txt and a one-off SBOM with today's verdicts. - From €29/product — daily vulnerability watch, plain-language verdicts, weekly status e-mail. - Higher tiers — multiple products, public trust page and evidence pack PDF. Pricing announced at launch. Join the waitlist — we'll let you know at launch and send you the first steps towards CRA readiness. [Find out in 2 minutes whether the CRA applies to you](https://craguard.eu/checker) ## FAQ ### Does the CRA apply to SaaS? Mostly not — unless it's cloud functionality necessary for a product to work. SaaS falls under NIS2. ### Does it apply to products I already sell? The reporting obligation from 11 September 2026 does. Full requirements apply on substantial modification or a new placement after 11 December 2027. ### Do I have to publish my SBOM? No — it's part of your technical documentation, provided to the authority on request. ### Do I need certification? Most products are "default" class = self-assessment. Only Annex III/IV categories need a notified body or certification. ### I'm just an agency — am I affected? The manufacturer is whoever places the product on the market under their own name — your client. They'll want the documentation from you. ## Key facts - The Cyber Resilience Act is Regulation (EU) 2024/2847; obligations phase in over time. - From 11 September 2026: report actively exploited vulnerabilities and severe incidents (24 h / 72 h / 14 days) via ENISA's Single Reporting Platform. - From 11 December 2027: no product with digital elements on the EU market without CE marking and the Annex I security requirements. - Penalties up to €15 million or 2.5 % of worldwide annual turnover. Source: EUR-Lex (Regulation (EU) 2024/2847); European Commission guidance of 27 July 2026. Scope-checker ### Find out whether the CRA applies to you Six questions, two minutes, no account. Get your product class and first steps. [Start the scope-checker](https://craguard.eu/checker) [Find out in 2 minutes whether the CRA applies to you](https://craguard.eu/checker) --- Source: CRAguard — https://craguard.eu