CRA compliance for connected products.
Done with you,
not handed to you.
Roja is the CRA team you don't have: SBOMs from your build, 24/7 vulnerability monitoring, ready-to-submit 24-hour reports and your compliance documents. Engineers included, from €290/month.
EU-hosted·Every requirement mapped to the article·No certification claims, just the work done
Reporting is mandatory since 11 Sep 2026 / Full compliance required by 11 Dec 2027
11 December 2027 ↗
What happens if
you don't comply.
The CRA is part of bringing connected products to Europe. The consequences are real. Preparing for them can be practical.
A team that keeps watch.
Monitoring, engineer-led triage, and reporting drafts. A practical first step toward keeping supported releases under control.
See exactly what's included ↗*Article 64: the higher of €15 million / 2.5% of worldwide annual turnover for essential requirements and manufacturer obligations; €10 million / 2% for other obligations; €5 million / 1% for incorrect or misleading information. These are maximums, decided by national authorities. Read the regulation. Article 14 reporting has applied since 11 September 2026. See the penalties guide for exceptions.
The platform is useful.
The people make it work.
Done-for-you CRA work at a price a 20-person company can pay. Enterprise platforms and consultancies often quote privately. We publish our prices.
| What you need | DIY compliance software | Enterprise / consultancy | Roja |
|---|---|---|---|
| Who does the work? | Your team | Your team or quoted consultants | Our engineers, with you |
| Published price | Selected tools: €79–€1,000 / mo* | Often a custom quote | Monitor from €290 / mo |
| SBOM from your build | Tool and integration dependent | Product / engagement dependent | Validated in assessment / projects |
| 24h reporting drafts | Workflow varies; your team prepares | Confirm scope in quote | Included with Monitor |
| Technical documentation | Templates / automation vary | Confirm scope in quote | Ready for 2027 project |
| Engineering remediation | Your team | Quoted separately or in scope | 40–120 hours in project package |
Different service models, not equivalent packages. Assessment and implementation are separate from Monitor. *Selected published / brief-supplied prices as of October 2026; unverified figures are labelled in the full sourced comparison.
From “where do we start?”
to “we're on top of it.”
Start with one product. Get the evidence. Close the gaps. Keep watch. Each step has a defined scope and a published price.
Start with a Snapshot
One product. A component inventory, known vulnerabilities, likely class and your ten biggest gaps. A useful answer in 48 hours.
Free ↗ 02 /Know where you stand
A validated SBOM, triaged findings, all 21 Annex I requirements mapped, and a clear route to December 2027.
From €1,900 ↗ 03 /Do the actual work
Technical file, policies, risk assessment, declaration draft and 40–120 hours of engineering help. In 8–16 weeks.
From €9,000 ↗ 04 /Keep every release covered
Daily monitoring. Human triage. Exploited-vulnerability alerts within an hour. Reporting drafts when the clock starts.
From €290/mo ↗All prices in EUR, excluding VAT. Assessment and implementation are separate engagements. Monitor is an ongoing subscription.
When the clock starts,
you have a team.
We prepare copy-ready drafts for ENISA's Single Reporting Platform. You review and submit. Accountability stays clear.
Early warningInitial awareness, affected product and the facts available.
NotificationUpdated assessment, impact and mitigation measures.
Final vulnerability report, after a fixFor severe incidents: one month after notification.
Automation watches.
Engineers make the call.
A list of CVEs is the beginning. Knowing which ones matter to your actual product takes context, evidence and a person who understands your build.
Consistent, around the clock.
- Keep an SBOM for every supported release
- Match components against publicly known vulnerabilities
- Track CISA KEV and ENISA EUVD exploited lists
- Keep the reporting clock and an evidence trail
Judgement, with the context.
- Validate the inventory against your build
- Triage applicability and document VEX decisions
- Prepare reporting drafts and technical documents
- Help fix the problem in your own code
Small team.
Real-world responsibility.
Smart-home manufacturers ↗
Plugs, sensors, cameras and locks. Product classification, embedded builds and the security responsibilities that follow them.
EU MARKET ACCESS / 02Manufacturers outside the EU ↗
Based in China, Taiwan, Turkey, the US or the UK? Your products can still fall in scope when sold into Europe.
Good engineering.
Honest scope.
We do not certify products, act as a notified body, give legal advice or conduct penetration testing. Accredited partner labs do the testing. Where your conformity route needs a notified body, we help you prepare the evidence.
Default-class products may use self-assessment. Class I needs a documented review of the applicable route; Class II requires third-party assessment. We explain the distinction before a project starts.
Understand your product class ↗A little clarity goes a long way.
Does the CRA apply to my product?
It generally covers hardware and software with a data connection made available on the EU market, including necessary remote processing. Pure SaaS and specific regulated sectors have exclusions. Our scope checker gives an initial indication; classification needs a documented review.
When do I have to report?
Article 14 has applied since 11 September 2026. Awareness of an actively exploited vulnerability or a severe security incident starts the 24-hour early-warning and 72-hour notification clocks. The final-report timing depends on the event type.
What are the fines?
Article 64 sets maximums up to the higher of €15 million or 2.5% of worldwide annual turnover for essential requirements and manufacturer obligations. Other tiers apply to other breaches. National authorities determine actual fines.
Do I need a notified body?
Most default products allow self-assessment. Important Class I products allow self-assessment only when the relevant harmonised standards or other permitted routes are fully applied; otherwise third-party assessment is needed. Class II requires third-party assessment. Critical products have specific certification requirements.
Which SBOM formats do you work with?
We work with machine-readable CycloneDX and SPDX inventories and validate them against the build and release. The CRA requires at least top-level dependencies; the right inventory should also make vulnerability matching practical.
Do you certify products?
No. We do not certify products, act as a notified body, give legal advice or perform penetration testing. Accredited partner labs conduct testing; we help prepare the evidence and coordinate the work.
We are outside the EU — does it apply?
Yes, location does not remove obligations when you make in-scope products available on the EU market. Document the manufacturer, importer and any representative roles. A local distributor does not automatically take over your manufacturer duties.
We are a small company — what changes?
Core product-security duties still apply. Article 64(10) exempts micro and small enterprises from fines for missing the 24-hour early-warning deadline only. It does not remove the reporting obligation, other deadlines or other duties.
Where is our data stored?
The service is designed for EU hosting. Before sharing build artifacts, we agree on the data location, access, retention and authorisation in writing. Website requests use Cloudflare and Brevo; see the privacy notice for those processors.
How fast can you start?
Start with one product and a free Snapshot. Once we receive the agreed inputs and authorisation, we prepare an 8–12-page report within 48 hours. Readiness assessments take two weeks; implementation projects typically take 8–16 weeks.
Your product.
Your gaps.
Your next steps.
Get a free CRA Snapshot in 48 hours.
One product. An 8–12-page PDF with your component inventory, known vulnerabilities, exploited-list matches, likely class and ten priority gaps.
No card. No surprise subscription. We'll agree on a one-page authorisation before accessing your build.