The CRA Compliance Control Room for Digital Product Manufacturers.

The sovereign platform to run your CRA compliance roadmap (79 tasks, phases P0-P6), generate your 27 document templates, manage SBOMs, and secure your Article 14 reporting under 24h.

Start free audit Free Demo → The CRA Mandate
€15M
Maximum CRA Fine
24h
Incident Reporting Deadline
Dec. 2027
Full CRA Application
EU
Assess + Operate Suite
Regulatory Framework

The CRA is in Effect. The Clock is Ticking.

The EU Cyber Resilience Act turns product cybersecurity into an operational obligation. Manufacturers now need evidence, reporting workflows, and audit discipline before the 2026 and 2027 deadlines.

// DECEMBER 2024

CRA Entry into Force

The regulation applies across the EU. All digital product manufacturers must launch their compliance program immediately.

// SEPTEMBER 2026

Reporting Obligations

Manufacturers must report actively exploited vulnerabilities and severe incidents through the CRA Single Reporting Platform, including an early warning within 24 hours after becoming aware.

// DECEMBER 2027

Full Product Compliance

Products with digital elements placed on the EU market must meet the applicable CRA cybersecurity, conformity-assessment, technical-documentation, and CE-marking requirements.

Why CRA-Direct.fr

At the Intersection of EU Law, Cybersecurity, and Engineering

CRA Direct turns CRA readiness into a working system: scope evaluation, product classification, Annex I control assessment, Annex VII documentation, SBOM evidence, vulnerability monitoring, human review, reporting preparation, and audit evidence.

Deployed on your own infrastructure or private cloud, designed for regulated evidence handling, CRA Direct gives auditors, technical teams, security teams, and compliance leaders one command center instead of scattered spreadsheets, tickets, questionnaires, and scanner exports.

100% Data Sovereignty

Deploy on your own infrastructure or private cloud. Your data never leaves your controlled environment. Full GDPR compliance by design (Art. 25).

Deterministic Compliance Roadmap

Coordinate 79 execution tasks across 7 phases (P0 to P6) mapping all 197 controls. Automated completion bindings derive progress from locked SBOMs and sent stages.

Audit-Ready Evidence Integrity

Maintain hash-chained audit trails and export SHA256 integrity bundles. Protect submissions with AI draft guardrails to prevent hallucinations.

Documentation Catalog

Access 27 template document types with automated context prefilling to editable DOCX, placeholder verification on upload, and proactive email alerts.

What We Offer

Assess. Operate. Evidence.

One CRA lifecycle suite for scope, classification, Annex I controls, technical documentation, SBOM evidence, vulnerability operations, Article 14 workflows, remediation, and audit trails.

FLAGSHIP

CRA Direct Platform

Centralized workspace combining a deterministic 79-task CRA compliance roadmap, automated document generation, and continuous audit-ready compliance operations across your product portfolio.

Automated flowsReal-time scoreMulti-productOn-Premises / Private Cloud

CRA Direct Assess

Scope evaluation, product classification, conformity route, and Annex I control assessment mapping all 197 controls to a structured, deterministic compliance roadmap.

197 controls79 roadmap tasksPrioritized

CRA Direct Operate

Manage Article 14 reporting workflows (24h/72h/final) with human-in-the-loop approval gates, automated draft validation, and stuck-mitigation monitoring.

24h workflowApproval gatesSRP-ready

SBOM Management

Ingest, validate, store, and monitor Software Bills of Materials (CycloneDX & SPDX) with immutable baselines, S3 evidence locking, and automated dependency mapping.

CycloneDXSPDXAuto-generated

Vulnerability Monitoring

Monitor OSV, KEV, EPSS, and EUVD exploit intelligence in real-time, generate automated impact deltas on new threats, and preserve append-only evidence chains.

CVE MonitoringPatch trackingAudit-ready

CE Documentation Support

Organize and generate the document catalog using 27 prefilled templates, editable DOCX downloads, Word XML placeholder checks, and compliance reminder schedules.

CE MarkingAudit-readyAuto-generated
Frequently Asked Questions

Everything You Need to Know

The Cyber Resilience Act (CRA) is the most important EU regulation ever adopted regarding digital product cybersecurity. It imposes mandatory security requirements on all manufacturers of products with digital elements on the EU market.

The CRA applies to any manufacturer, importer, or distributor of products with digital elements on the European market — whether based in Europe or not. This includes SaaS providers, IoT manufacturers, app developers, hardware builders.

Three key dates: 10 December 2024 — the CRA entered into force. 11 September 2026 — Article 14 reporting obligations apply. 11 December 2027 — the CRA applies in full, including conformity assessment and CE-marking obligations for products placed on the EU market.

An SBOM (Software Bill of Materials) is an inventory of software components. Under the CRA, manufacturers need component and vulnerability-handling evidence to support supply-chain traceability, security maintenance, technical documentation, and ongoing vulnerability operations.

Yes. CRA Direct is available as an on-premises or private cloud deployment for organizations that require 100% data sovereignty. Your compliance evidence — SBOMs, vulnerability data, incident reports, audit trails — stays entirely within your controlled environment, behind your own security perimeter.

Duration varies by product complexity, classification, evidence maturity, and whether third-party conformity assessment is needed. A readiness assessment can usually identify the scope, classification, evidence gaps, and roadmap within 2 weeks.

Contact Us

Start Your Compliance Journey

Don't wait for the deadline. Every month of delay reduces your room for maneuver. Contact us for a free consultation or platform demo.

✅Response guaranteed within 24 business hours
✅Confidential exchange, no obligation
✅Europe-based, multilingual experts
✅Preliminary diagnostic offered during demo