Ready for December 2027
A CRA compliance project prepares the engineering evidence and documentation needed for the selected conformity route. Our engineers work with your team on the product, the technical file and the process that keeps both current.
What you get.
- Everything in the readiness assessment
- Cybersecurity risk assessment and Annex II user information
- CVD policy, security.txt and support-period statement
- Annex VII technical file and Annex V declaration draft
- 40–120 engineering hours for remediation
- Article 14 reporting drill
- Coordination with your test lab or notified body
What we need from you
An accountable product owner, agreed access to builds and code, a release plan and time from your engineering team. The fixed scope is agreed after product discovery. Projects range to 24000 EUR.
What is outside the scope
No product certification, legal opinions or penetration testing. Lab and notified-body fees are separate. The manufacturer approves and signs the declaration.
We document assumptions and evidence gaps rather than treating a scan as proof. Every accepted deliverable has an owner and a review step. Your engineers can inspect how findings relate to the release and which decisions still need confirmation.
Learn how this work fits the Cyber Resilience Act, the SBOM requirements and the Article 14 reporting process.
From access to usable evidence.
Set the boundary.
Identify the product family, supported versions, build inputs, data location and authorised access. Agree a named contact and the deliverables before we start.
Build the evidence.
Connect inventory to the release. Check findings with the people who know the code. Record decisions with article references and identify what needs engineering attention.
Make the handover useful.
Review the findings together. Separate verified facts from open questions. Assign owners, next actions and dates so the work survives the next product release.
Before we start.
Who remains responsible for compliance?
The manufacturer remains accountable for classification, conformity decisions, reporting and signing the declaration. We prepare evidence and drafts and help with engineering work.
Can we start without sharing all our source?
Yes. We agree the minimum inputs first. An existing SBOM or build output can be a starting point. If those inputs cannot support a conclusion, we document the limitation and agree what is needed next.
What are the payment terms?
Project work is 50% upfront, with the remainder according to the agreed milestones. Invoices are in EUR, excluding applicable VAT. Subscription scope and billing are agreed before activation.
Do you handle certification or penetration testing?
No. Accredited partner labs carry out testing, and notified bodies handle routes that require their involvement. Their fees and scope are agreed separately.
Let's see what your
product needs.
Start with a free Snapshot. We agree the inputs and authorisation before reviewing your build.