CRA Toolkit
Assessment, SBOM guidance, vulnerability disclosure templates and regulation-aware assistance for the EU Cyber Resilience Act.
The problem
A long regulation, turned into tasks.
The EU Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity requirements for products with digital elements sold in the EU. It covers software and connected hardware, and it applies across the product lifecycle: secure design, vulnerability handling, security updates and documentation.
For many vendors, the difficulty is not understanding that the rule exists. It is turning a long legal text into a list of concrete tasks: which category your product falls into, what documentation you must keep, how to run vulnerability handling, and what to report when something is exploited.
Our approach
Structured, and grounded in the text.
CRA Toolkit turns the regulation into a structured workflow. You answer questions about your product, and the tool shows which requirements apply, what evidence you need and what is still open.
Its assistant is grounded in the regulation text and answers with references, so you can check the source. When the text does not cover a question, it says so instead of guessing.
Capabilities
What is in the toolkit.
- Compliance assessment and requirement explorer
- Compliance dashboard and exportable reports
- SBOM guidance
- Vulnerability disclosure policy templates
- Vulnerability lookup
- security.txt generator
- Risk assessment wizard
- Regulation-grounded AI assistant
- Knowledge hub on CRA topics
Questions
CRA questions
What is the EU Cyber Resilience Act?
The Cyber Resilience Act (Regulation (EU) 2024/2847) sets mandatory cybersecurity requirements for products with digital elements placed on the EU market. It covers secure design, vulnerability handling, security updates, documentation and reporting. Reporting duties apply from 11 September 2026 and the main obligations from 11 December 2027.
Who needs to comply with the CRA?
Manufacturers of products with digital elements sold in the EU, plus importers and distributors, each with their own duties. That includes software and connected hardware. Some free and open-source software is outside the scope, and open-source stewards have lighter obligations.
What is an SBOM and does the CRA require one?
A software bill of materials lists the components in a product. The CRA requires manufacturers to identify and document components, including an SBOM in a commonly used, machine-readable format covering at least top-level dependencies, as part of the technical documentation.
Does CRA Toolkit replace legal advice?
No. It helps you organise scope, requirements and documentation, and its assistant points to the regulation text. Decisions about your specific products should be checked with your own counsel.
Need CRA help beyond the tool?
We also advise on AI-assisted compliance workflows, SBOM and vulnerability handling processes.