What is the CRA compliance
The Cyber Resilience Act (CRA) is an EU regulation that sets mandatory cybersecurity requirements for hardware and software products with digital elements (from connected devices to many standalone software products).

CRA compliance is the state where a manufacturer (and, in parts, importers and distributors) can demonstrate that these products are secure by design, have proper vulnerability management, and meet all documentation, reporting, and conformity assessment duties required by the Act.
Who needs to comply?
  • Manufacturers of products with digital elements: companies that design and build hardware or software products (including connected devices, embedded systems, and many stand‑alone software products) are the main duty‑holders under CRA.
  • Importers: organisations that bring digital products from outside the EU into the EU market must ensure they only place CRA‑compliant products on the market and take on specific label, documentation, and cooperation obligations.
  • Distributors and resellers: businesses that further distribute or resell products with digital elements inside the EU must verify that products bear the correct conformity markings and that obvious non‑compliance is not ignored.
What does CRA compliance involve?
CRA Applicability & Scope Assessment
We assess whether your products with digital elements fall within the CRA scope, identify applicable obligations, and clarify your role as manufacturer, importer, or distributor.

Secure Development & Lifecycle Requirements
We help align your product development practices with CRA expectations, including secure-by-design principles, vulnerability handling, security updates, and technical documentation.

Gap Analysis & Readiness Roadmap
We evaluate your current product security, documentation, and governance controls against CRA requirements, then provide a practical roadmap to close gaps before enforcement deadlines.

Vulnerability Management & Disclosure Process
We design or refine coordinated vulnerability disclosure, remediation, and reporting processes so your team can manage product vulnerabilities in a structured and compliant way.

Technical Documentation & Evidence Preparation
We support the creation of policies, procedures, risk records, software bill of materials inputs, and other evidence needed to demonstrate compliance and support conformity assessment.

Governance, Roles & Responsibilities
We help define internal ownership across product, engineering, legal, and security teams to ensure CRA obligations are embedded into governance and decision-making.
Key Elements of the CRA compliance
CRA compliance involves designing and running your products so they meet the EU Cyber Resilience Act’s security, documentation, SBOM, and reporting requirements over their entire lifecycle, enabling lawful CE‑marked access to the EU market.

Secure‑by‑design and secure‑by‑default products
You must build security into planning, design, development and testing, ship secure default configurations, and minimise known vulnerabilities and attack surface before placing products on the market.

Lifecycle vulnerability and incident management
Manufacturers need processes to monitor, triage and fix vulnerabilities, plus report actively exploited vulnerabilities and severe incidents via the CRA reporting channel within strict timelines.

Software Bill of Materials (SBOM)
CRA requires manufacturers to create, maintain and retain SBOMs for products with digital elements, capturing software components in a machine‑readable format to support vulnerability management, technical documentation and regulator requests.

Technical documentation and CE conformity
You must maintain product‑specific technical files (risk assessments, security architecture, test results, SBOM, update policy, support period, etc.) and undergo the appropriate conformity assessment so the product can legitimately bear the CE mark.

Governance, roles and supply‑chain controls
CRA expects clear assignment of responsibilities inside the organisation and appropriate requirements on suppliers, so that third‑party components and vendors do not undermine product security or your ability to meet CRA duties.
Align CRA with Other Frameworks
CRA doesn’t replace your current security and compliance work – it builds on it. We analyse where your ISO 27001, NIS2, DORA and GDPR programmes already meet CRA expectations, identify the product‑security gaps (secure‑by‑design, SBOM, vulnerability reporting, CE documentation), and design a practical roadmap that connects CRA with the controls and processes you already have in place.