CRA evidence, straight from your firmware build.
For small teams shipping connected devices in the EU. The bill of materials, vulnerability watch and technical file the Cyber Resilience Act asks for, without hiring a compliance team.
Pilot starts February 2027 · 10 teams · Zephyr and ESP-IDF first
days until every connected product sold in the EU needs this evidence.
From 11 December 2027, a product without it cannot legally be placed on the EU market. Reporting duties have already started.
to send an early warning once you learn a vulnerability in your product is being actively exploited. In force since 11 September 2026.
Regulation (EU) 2024/2847, Article 14of small firms surveyed said they understand the documentation the CRA requires. 66% had heard of the law.
ENISA SME CRA survey, 2026. 194 firms, not a representative sample.or 2.5% of worldwide turnover: the maximum fine for breaching the essential requirements. Products can also be pulled from the market.
Regulation (EU) 2024/2847, Article 64The whole problem, and the fix, in under a minute.
Three pieces. One plugs into the build you already have.
Build plugin
An open-source plugin runs with your normal firmware build and writes a software bill of materials: every component and version that ends up in the image.
Vulnerability watch
The hosted service keeps the list for every firmware version you ship and checks it daily against public vulnerability databases. You hear when something you shipped is affected.
Technical file
Your technical documentation is kept current from the same data, and incident reports are drafted for you, so the 24-hour and 72-hour deadlines are realistic.
Screens are illustrations of the planned product. Commands and component names are examples.
Each obligation, and what the kit does about it.
Does the CRA apply to your product?
Four questions, about a minute. The answer is an indication based on the regulation's scope rules, not legal advice.
Ten teams, starting February 2027.
You get a working setup on one product line and direct support while you set it up. In return we ask for honest feedback.
Pilot starter pack
- Build plugin set up on your Zephyr or ESP-IDF project
- Bill of materials for your current release
- Gap report against the CRA essential requirements
- Technical file skeleton, filled in from your build
- Vulnerability watch for the length of the pilot
Reserve a place
A €300 deposit holds your place and is credited against the starter pack. Fully refundable until the pilot starts.
Pay €300 depositBefore you ask.
Will this make our product CRA compliant?
No tool can do that alone. Compliance also depends on how your product is designed and how you run your processes. The kit produces and maintains the evidence the regulation asks for, and tells you where the gaps are. It does not certify anything, and it is not legal advice.
Does our source code leave our build server?
No. The plugin runs locally and uploads only the component list: names, versions and licences. Source code and firmware binaries stay with you.
Which build systems are supported?
The pilot covers Zephyr and ESP-IDF. Yocto and PlatformIO are next. Tell us what you use in the form above; it decides the order.
What happens after the pilot?
A monthly subscription per product line, planned at €99–299 depending on the number of releases you ship. Pilot teams keep the lowest tier price for the first year.
Our product is a smart lock or camera. Can we still use it?
Yes for the evidence, but products in the stricter "important" classes may also need an assessment by a third party. Run the scope check above to see which class you are likely in.
– days. Ten pilot places.
Start with one product line and find out where you stand before the deadline does it for you.