CRA compliance you demonstrate, not promise
The reporting obligation under the Cyber Resilience Act (Regulation (EU) 2024/2847) has been live since 11 September 2026. The main obligations apply from 11 December 2027. We make that reporting obligation operational for manufacturers of products with digital elements: sovereign, self-hosted, no US cloud.
From
The reporting clock is ticking, and documentation is not execution
The Cyber Resilience Act places the reporting obligation on the manufacturer of the product. As soon as an actively exploited vulnerability or a severe incident is identified, a chain with hard deadlines starts. Most manufacturers have a security policy on paper, but no operational reporting channel that is ready within 24 hours. That gap between the compliance document and the execution is exactly where things go wrong when it counts.
First signal via the ENISA Single Reporting Platform as soon as an actively exploited vulnerability or severe incident is identified.
A substantiated notification covering impact, severity and the first corrective measures.
Closing report: for a vulnerability within 14 days after a corrective or mitigating measure is available, for a severe incident within 1 month after the 72-hour notification. Covering cause, severity and course of events.
Five requirements, 1 operational whole
Reporting workflow
The 24h and 72h deadlines and the final report (14 days for a vulnerability, 1 month for a severe incident) built in, with reporting via the ENISA Single Reporting Platform. Countdowns and alerts so you never miss a deadline.
SBOM and vulnerability handling
A CycloneDX SBOM per product line plus continuous vulnerability handling across the entire support period. Knowing what is inside your product is the basis of every report.
Secure-by-design and CE
The essential requirements of Annex I translated into concrete product requirements, as evidence for the CE conformity of your product with digital elements.
Active-exploitation detection
Flag which vulnerabilities in your product are being actively exploited, so the 24h clock starts on time.
Audit trail for market surveillance
Every report, SBOM version and remediation action recorded with timestamp and owner, so you can show the market surveillance authority what you did and when.
Simple, Sovereign, Secure-by-design
The reporting obligation as 1 workable process
No legal maze, but 1 configured workflow with deadlines, playbooks and ownership. Your team knows what to do when the clock starts.
On your own infrastructure
Self-hosted and European. Your SBOMs, reports and audit trail stay inside your own environment, with no dependency on a US cloud.
The requirement is the starting point
The essential requirements of Annex I are part of the design, not an afterthought. Compliance follows from how the product is built, not the other way round.
Your data stays yours
The entire environment runs on your own infrastructure: on-premise or in your own private cloud. No external telemetry, no SaaS dependency. Your SBOMs, reports and audit trail never leave your environment. Sovereign AI Grid is set up on steward-ownership principles: governance in the public interest, not in the shareholders' interest. That principle extends all the way to how your compliance tooling handles your data.
Delivered as a project, with your own environment
You get more than tooling: you get a configured programme. We deliver a sovereign, self-hosted project environment in which the entire CRA programme runs: SBOMs, reporting playbooks, deadlines and ownership in 1 place. A phased start is possible: set up 1 product line first, then extend across your portfolio.
Tool and project environment
Reporting workflow and SBOM management plus a self-hosted project environment, delivered together.
Playbooks as tasks
The 24h/72h/14d steps become concrete, assignable tasks with an owner and a deadline.
Phased start
Start with 1 product line, then scale up to multiple lines or your entire portfolio.
From one-off reporting-ready to continuously assured
Three tiers, from a one-off reporting-readiness programme to continuous monitoring. We set the indicative price together in a short briefing, tailored to your product portfolio and scope. So you pay for what you need, not for a standard package.
CRA reporting readiness
A one-off programme. Scope defined, CycloneDX SBOM produced and the 24h/72h/14d reporting playbooks set up. After this programme you are ready to report.
Indicative price in the briefing
Storage, processing and reporting channel
Ongoing, tiered by product line and size. Monitoring of actively exploited vulnerabilities, SBOM maintenance and the 24h/72h/14d reporting workflow on standby.
Indicative price in the briefing
Multi-product portfolio
Large or multi-product portfolios, multiple product lines or specific supervisory requirements. We agree scope and price up front in a briefing.
Custom scope and price
In a 20-minute briefing we determine the tier, the scope and the indicative price together, tailored to your product portfolio. No obligation.
For the makers behind the products
The CRA affects everyone who places a product with digital elements on the European market. And more and more often the end customer, such as a municipality, a ministry or a large retail chain, demands this evidence from its supplier. This environment serves both sides of that chain.
Product maker
Place your product with digital elements on the market in conformity.
CTO / CISO
A reporting channel that is in place, and defensible evidence for the supervisor.
Compliance lead
From policy on paper to a demonstrably operational process.
End-customer context. Are you a municipality, ministry or retailer requiring this from a supplier? Then this environment is exactly what you can ask that supplier for as evidence.
Not every product falls under the CRA
The CRA applies to products with digital elements that fall within its scope. Article 2 excludes a number of categories that have their own regime: among others medical devices (under the MDR), motor vehicles and aviation. Those report and certify under their own legislation, not under the CRA. In the briefing we determine together whether, and for which product lines, the CRA applies to you. So you know up front what you are taking on: insight and a working process, not an empty promise.
The CRA, the Cyber Security and Resilience Bill and PSTI: 1 reporting rhythm
The CRA follows the product, not the headquarters: a UK manufacturer placing products with digital elements on the EU market is in scope. At home, the UK is building its own regime. The two do not cover the same ground, but they share the same reporting rhythm, so 1 workflow serves both.
Cyber Resilience Act
Applies to UK makers selling into the EU. Reporting via the ENISA Single Reporting Platform: 24h early warning, 72h notification, final report.
Cyber Security and Resilience Bill
The UK's update of its NIS regulations, now before Parliament. As drafted it extends to managed service providers and other digital suppliers, with an initial incident notification within 24 hours and a full report within 72 hours. Details follow in secondary legislation and regulator guidance.
PSTI Act 2022
In force since April 2024 for consumer connectable products: no universal default passwords, a published vulnerability disclosure policy and a stated security-update period. The SBOM and vulnerability handling above feed straight into it.
In the briefing we map which of the three applies to your products and your organisation, and set up 1 reporting workflow that meets every deadline that applies.
Connects to the rest of your compliance
NIS2 Compliance
The CRA is about your product, NIS2 about your organisation. Doing both? Then the duty of care under NIS2 connects directly to this.
View NIS2 Compliance (Dutch) →Vulnerability Intelligence
Detection of actively exploited vulnerabilities (KEV/EPSS) and CycloneDX SBOMs: the operational feed for your 24h reporting clock.
View Vulnerability Intelligence →SAIG Academy: CRA course
Get your team up to speed: "EU Cyber Resilience Act in practice", including the reporting obligation, SBOM and secure-by-design. Available in English.
View SAIG Academy →Request a briefing
Contact is where the engagement starts. Leave your details and we will schedule a short briefing: we determine the scope, the product lines and which tier fits. A sovereign, self-hosted CRA reporting obligation, no US cloud.