Get your software ready for the EU Cyber Resilience Act in an afternoon.
From 11 September 2026, a manufacturer who places software, apps or connected devices on the EU market has a new duty. As soon as it learns that a vulnerability in its product is being actively exploited, it must send an early warning within 24 hours. Then a notification within 72 hours, and a final report. CRA Kit tells you whether you are in scope. It checks your dependencies against OSV.dev and the CISA KEV catalogue. And it writes the documents a small team needs to get started, for €79 per product, without going through a law firm. Compliance is what you then implement.
What changes, and when
Regulation (EU) 2024/2847 applies to “products with digital elements”: software and hardware with a data connection, sold or monetised in the EU. Two dates matter for a small maker.
Reporting obligations (Article 14)
You must report actively exploited vulnerabilities and severe incidents to your national CSIRT and ENISA. Early warning in 24 h, notification in 72 h, final report 14 days after the fix is available (vulnerability) or 1 month after the notification (incident). You must also inform affected users. This applies to products already on the market too (Article 69).
Everything else (Article 13)
Essential security requirements, vulnerability handling with an SBOM, technical documentation, EU declaration of conformity, CE marking, and a support period of at least 5 years with free security updates.
Maximum fines (Article 64, from 11 Dec 2027)
For breaches of Annex I or Articles 13–14. Micro and small enterprises are in scope and fined proportionately. They cannot be fined for merely missing the 24-hour early warning (Article 64(10)), but the 72-hour notification and the final report still bind them. Non-EU companies selling into the EU are in scope too.
Three tools, one afternoon
1 · Scope test free
Eight questions. You get an automated, indicative assessment with the article references. It says whether you are in scope, which product class you fall into, which conformity route applies and which obligations start on which date. It also pre-fills the first document of your kit.
2 · SBOM & vulnerability scan free
Drop your lockfile (npm, pnpm, yarn, pip, poetry, uv, Go, Cargo, Composer, Gemfile, Maven, NuGet, Dart, Swift). You get a CycloneDX SBOM, the known vulnerabilities referenced by OSV.dev for open-source components, and the ones listed in the CISA Known Exploited Vulnerabilities catalogue. A KEV entry is a strong signal of active exploitation. The CRA clock only starts once your product is exposed and you know it. Files stay in your browser.
3 · The kit €79
13 documents generated with your company, product and contacts: CVD policy, security.txt, handling and reporting procedures, ENISA notification templates, support statement, Annex I/II/V/VII drafts, log. Markdown + HTML + a printable version (save as PDF from your browser), in English or French.
What is in the kit
Every document is generated from your answers and names the article it implements. They are yours to edit. Before paying you see three documents in full (plan, scope memo, security.txt) and the first part of each of the others.
| Document | Implements | You publish / keep |
|---|---|---|
| 00 · Start here: your 10-step plan by date | Articles 13, 14, 64, 71 | Keep |
| 01 · Scope & classification memo | Articles 2, 3, Annex III/IV | Keep (technical file) |
| 02 · Coordinated Vulnerability Disclosure policy | Annex I Part II (5) | Publish |
| security.txt (RFC 9116) | Annex I Part II (6) | Publish at /.well-known/ |
| 03 · Vulnerability handling procedure with SBOM, monitoring, SLAs | Annex I Part II, Art. 13(6)–(8) | Internal |
| 04 · Incident & exploited-vulnerability reporting procedure (24 h / 72 h / final), roles, decision tree | Article 14, 16 | Internal |
| 05 · Six ENISA notification templates + a user notice | Article 14(2), (4), (8) | Use when needed |
| 06 · Support period & security updates statement | Article 13(8)–(9), Annex II (7) | Publish |
| 07 · User information checklist | Annex II | Ship with product |
| 08 · Cybersecurity risk assessment: 1 general + 13 security properties + 8 vulnerability-handling requirements mapped | Article 13(2)–(4), Annex I | Technical file |
| 09 · Technical documentation skeleton | Article 31, Annex VII | Technical file |
| 10 · EU declaration of conformity draft | Article 28, Annex V/VI | Sign by 11 Dec 2027 |
| 11 · Vulnerability & release log (CSV) | Article 13(7) | Keep 10 years (recommended) |
| sbom.cdx.json (from the free scan) | Annex I Part II (1), Annex VII (8) | Technical file |
CRA Kit, per product
- 13 documents generated with your data, English or French
- Unlimited regeneration for this product (edit answers, new versions)
- Markdown + HTML + printable version (save as PDF), ZIP download
- Licence key by e-mail, works on up to 5 browsers
- Free updates of the templates as guidance evolves (re-generate)
Preview three documents in full and the start of the others before buying. This is digital content. Unlocking requires your express consent to immediate delivery, which ends the 14-day withdrawal right (see terms). Not legal advice.
Compared with the alternatives
| Option | Cost | Fit for a team of 1–10 |
|---|---|---|
| Law firm / consultant | €3,000–15,000 | Overkill until you have a notified-body product |
| Lawyer-drafted Word template pack | ~€700 | Generic. You still fill every page yourself |
| Enterprise SBOM platforms | €500+/month | Built for security teams |
| Free guides (ENISA, OpenSSF, law-firm blogs) | €0 | Good reading. Nothing generated, nothing to publish |
| CRA Kit | €79 | Generated with your data, ready today |
Who is behind this
Questions people ask
Is my SaaS in scope?
Pure SaaS, websites and online services are not “products with digital elements” (Recital 12). NIS2 may apply to them instead. But if you ship a client (mobile app, desktop app, agent, SDK, device) and your back end is designed by you and needed for one of its functions, that “remote data processing” is in scope together with the product. Run the scope test, it explains the reasoning.
I publish open source. Am I concerned?
Free and open-source software supplied outside a commercial activity is out of scope (Recital 18). Monetisation brings it back in. That means paid support, dual licensing, or a company that controls the project and sells around it. Foundations and package stewards have a light regime (Article 24). The kit has a specific path for the “open-source software steward” role.
What exactly happens on 11 September 2026?
Article 14 becomes applicable. Say you become aware that a vulnerability in your product is being actively exploited, or of a severe incident affecting its security. You then submit an early warning within 24 hours, a notification within 72 hours and a final report, through ENISA's single reporting platform, and you inform affected users. Nothing needs to be filed if nothing happens. But you need the account, the roles, the procedure and the templates ready before it does. The rest of the Regulation applies on 11 December 2027.
Why does the scan check the CISA KEV catalogue?
The CRA trigger is “actively exploited”. The Known Exploited Vulnerabilities catalogue is the most complete public list of vulnerabilities with confirmed exploitation. A KEV-listed vulnerability in a component you ship is not automatically reportable, since you first have to check whether your product exposes it. But it is the signal to start the decision tree the same day.
Is this legal advice? Does it make me compliant?
No and no. CRA Kit generates working documents from the Regulation's text and your answers, with article references so you can verify each one. Compliance is what you do with them. You publish them, staff the process, keep the log, fix what is broken and report when you have to. For important or critical products (Annex III/IV), or in any situation with real legal exposure, have a lawyer review the output.
Where do my files and company data go?
Nowhere. The scanner parses your files in the browser and sends only package names and versions to OSV.dev. The kit form is stored in your browser's local storage. Document generation happens locally. Licence keys are verified against Lemon Squeezy. We do not run a database.
Can I get a refund?
You can preview three documents in full and the beginning of the others before paying, and the free tools are yours regardless. Until you unlock, you can withdraw within 14 days. Unlocking requires you to expressly request immediate delivery of the digital content and to acknowledge that you lose the withdrawal right (Directive 2011/83/EU, Article 16(m)). The generated plan records that consent. If something is broken, write to us and we will fix it or refund you.