CRA · Cyber Resilience Act · EU regulation

CRA conformity — bring products with digital elements safely onto the EU market

We make your connected products CRA-conformant — with security by design, vulnerability management, an SBOM, the technical documentation and the right conformity assessment for CE marking.

  • Full service 7,500 – 24,900 € depending on company size
  • From 11.09.2026 the reporting duties apply
  • From 11.12.2027 the regulation applies in full
  • Can be combined with ISO 27001 and NIS-2
  • 30 minutes assessment
Book a CRA assessment Start the CRA check
notivia since 2003· +50 ISMS clients*· +20 Full-service projects*· ISO 27001, NIS-2 & the CRA in one platform· ★★★★★5.0

* Audit success relates to completed full-service certification projects since 2019.

Quick check

This page is for you if …

  • … you want to prepare for products with digital elements .
  • … you need to know whether your product is default, important or critical .
  • … you need a vulnerability management with an SBOM .
  • … you want to meet the reporting duty to ENISA from September 2026.
  • … you want to know what CRA conformity costs and how long it takes.
Our services for the CRA

Four building blocks. One route to compliance.

The Cyber Resilience Act — from classifying the product to the EU declaration of conformity.

Maximum support

Full-service support

We take your product through the whole CRA process — from classification under Annex III, through security by design and vulnerability management, to the technical documentation and the declaration of conformity.

This suits you if you want CRA conformity with as little internal project load as possible.
  • Product classification & scope
  • The security-by-design process
  • SBOM & vulnerability management
  • Technical documentation
from €7,500 one-off · M from 15,000 € · L from 24,900 € for one product or product family · plus third-party conformity assessment · all prices exclude VAT
Request a quote
Ongoing

Ongoing CRA support

We support your team day to day: vulnerability monitoring, the reporting deadlines to ENISA, delivering updates and maintaining the technical documentation across the whole support period.

This suits you if you have to keep the CRA running day to day — not just evidence it once.
  • Vulnerability monitoring
  • Reporting process: 24 h / 72 h / 14 days
  • Update & patch governance
  • Maintaining the technical documentation
from €900 / month
Enquire about ongoing support
12-month minimum term · 3 months' notice
One-off / yearly

Internal CRA review

We review your products and processes against Annex I parts I and II, the documentation duties in Annex VI and your reporting processes.

This suits you if you want to know where you stand before the conformity assessment.
  • A review against Annex I
  • Completeness of the SBOM
  • Evidence mapping
  • A report with an action plan
from €3,500 one-off
Enquire about an audit
Self-service

Build it yourself

Build CRA conformity yourself — the ISMS platform takes you through the requirements step by step.

  • The guide shows the next step
  • AI produces your documents
  • 800+ templates to build on
  • Support can be added at any time
from€249/ month · cancellable monthly
See the self-service option

Additionally for the CRA

Standard-specific extras — bookable individually

Building the SBOM

Creating the software bill of materials, keeping it current automatically and wiring it into the build process.

from €2,900

ENISA reporting process

Setting up and rehearsing the process for the 24-hour early warning and the 72-hour report.

from €2,490

Combined review with ISO 27001

One internal review for both — saves around 40 % of the effort.

from €4,500
Ongoing CRA support: 12-month minimum term · 3 months' notice to the end of the month · all prices exclude VAT.
Free initial assessment

Product cyber resilience to CRA — clarity in 30 minutes

The new EU product regulation: what you have to put in place, from when, and what it costs.

Lead consultant
Lead consultant
Your contact
  • A quick answer
  • Realistic figures for time and cost
  • No sales pressure, no obligation
  • From notivia GmbH, Stuttgart — since 2019
think why NETFORMIC Animus Intelligence Crest Digital Veoma VERDURE
Book directly — the quickest way
Pick a 30-minute slot yourself
or send us a message

    No spam·No obligation·A quick answer·GDPR-compliant
    Prefer to call? +49 711 35 15 705
    Start on your own

    Two tools — ready to use right now

    Before you get in touch: work out the cost and explore the platform — free and without obligation.

    Free CRA check · 3 min

    Does the Cyber Resilience Act cover your product?

    10 questions on product type, digital elements, route to market and update capability. In 3 minutes you will know whether the act covers you, and how far.

    Start the check

    Or do it yourself

    The ISMS platform with its CRA module

    The multi-standard ISMS covers product classification, the SBOM, vulnerabilities and the reporting deadlines — made for teams that want to document the CRA in a structured way.

    Explore the platform
    Guide · PDF

    CRA guide for product owners

    What the regulation requires, which deadlines apply, how the conformity assessment works — explained plainly.

    Download the guide
    The standard in brief

    What has to be in place for the ISO 27001?

    Eight building blocks — the mandatory set for a CRA-conformant product.

    1. Product classification under Annex III / IV
    2. Cyber security risk assessment (Art. 13)
    3. Security by design (Annex I part I)
    4. Vulnerability handling (Annex I part II)
    5. SBOM — software bill of materials
    6. Reporting duties to ENISA (Art. 14)
    7. Technical documentation (Annex VI)
    8. Conformity assessment & CE marking

    In the initial call we show you which points you already meet.

    Book a free initial assessment
    WHO IS IT FOR?

    Who does the CRA apply to?

    The CRA applies to every economic operator that makes products with digital elements available on the EU market — wherever they are produced.

    Manufacturers

    Whoever develops a product, or sells it under their own name, carries full responsibility: the risk assessment, security by design, updates across the support period and the reporting duties.

    Importers

    Whoever brings products from third countries into the EU must check, before placing them on the market, that the conformity assessment, the CE marking and the documentation are in place.

    Distributors

    Whoever resells products must check the CE marking and act on any known risk — informing the manufacturer and the authorities.

    DUTIES

    The core duties under the CRA

    The Cyber Resilience Act is a regulation — it applies directly, without national transposition. These duties fall on manufacturers directly.

    13

    Duty of care

    A cyber security risk assessment, security by design and documentation across the whole lifecycle.

    14

    Reporting duties

    Actively exploited vulnerabilities and severe incidents, to ENISA and the national CSIRT.

    13.8

    Support period

    Security updates for at least five years — or for the expected lifetime if that is shorter.

    13.17

    Conformity assessment

    Depending on the product class: internal control, EU type examination or full quality assurance.

    20

    Importer duties

    Checking conformity, marking and documentation before placing on the market.

    21

    Distributor duties

    A duty of care in the supply chain and a duty to inform where risks are known.

    23

    Market surveillance

    National authorities can demand evidence, test products and prohibit sale.

    64

    Penalties

    Up to 15 million € or 2.5 % of worldwide annual turnover — whichever is higher.

    ANNEXES

    The annexes of the CRA

    The annexes spell out what „cyber security" actually means for a product.

    I

    Requirements

    Part I: product security. Part II: vulnerability handling. The heart of the regulation.

    II

    Information for users

    What has to be supplied to the user — from the support period to the point of contact.

    III

    Important products

    Class I and II: password managers, VPNs, firewalls, operating systems, hypervisors and more.

    VI

    Technical documentation

    What the documentation must contain: the description, the risk assessment, the SBOM and test reports.

    ANNEX I HIGHLIGHTS

    What the product has to do

    Annex I part I defines the product properties, part II the processes behind them.

    A secure default configuration

    The product ships without known exploitable vulnerabilities and with a secure default setting.

    Protection from unauthorised access

    Authentication, identity and access management to the state of the art.

    Confidentiality & integrity

    Encryption of data at rest and in transit, and protection against tampering with commands and code.

    Data minimisation

    Process only the data the function actually needs.

    Availability & resilience

    Protection against denial of service and limiting the effect on other services.

    Limit the attack surface

    Reduce external interfaces and contain the effect of an incident through isolation.

    Security updates

    Updates must be supplied promptly, free of charge and — where possible — automatically.

    SBOM & dependencies

    A machine-readable software bill of materials covering at least the top-level dependencies.

    Coordinated disclosure

    A documented point of contact and a process for reported vulnerabilities.

    OVERLAP

    ISO 27001 as the foundation for the CRA

    An existing ISMS takes a substantial part of the CRA work off your hands. Risk management, supplier control, the vulnerability process, incident response and document control are the same building blocks in both worlds. The CRA adds what is specific to products: classification, security by design, the SBOM, the support period and the CE conformity assessment. Typically that already covers around half of the CRA requirements.

    CRAISO 27001
    Art. 13 risk assessment Cl. 6 risk management (the same approach)
    Annex I vulnerabilities A.8.8 handling vulnerabilities
    Art. 14 reporting duties A.5.24–5.28 incident management
    SBOM & supply chain A.5.19–5.23 supplier relationships
    Annex VI documentation Cl. 7.5 documented information
    Secure development A.8.25–8.31 secure development
    around 50 %
    overlap in processes and evidence — depending on how mature your ISMS is
    OUR SOLUTION

    Implementing the CRA with iso-easy

    1

    Classify the products

    Recording every product with digital elements and classifying it against Annexes III and IV.

    2

    Gap analysis

    Comparing your existing development and security processes against Annex I parts I and II.

    3

    Build the processes

    Security by design, the SBOM, vulnerability handling, the reporting process and the technical documentation.

    4

    Declare conformity

    Carrying out the conformity assessment, affixing the CE marking and keeping the documentation available.

    Product classification SBOM Security by design ENISA reporting process Technical documentation CE conformity

    Or do it yourself

    The ISMS platform for the CRA — and 10 further standards

    Digitalise product classification, the SBOM, vulnerabilities and the reporting deadlines in a multi-standard ISMS. With an AI copilot, templates and the audit guide — made for teams with internal resources that want to document the CRA provably.

    • Multi-standard ISMS
    • AI copilot & templates
    • Audit guide
    • Cancellable monthly

    from €249

    / month · Starter with 1 standard

    Explore the platform
    FAQ

    Frequently asked questions about the CRA

    What is the Cyber Resilience Act?
    The Cyber Resilience Act — Regulation (EU) 2024/2847 — is the first EU law that places cyber security requirements on products themselves. It covers every „product with digital elements": software, connected devices, machines with firmware. Without CRA conformity such products may no longer be placed on the EU market from December 2027.
    From when does the CRA apply?
    The regulation entered into force on 10 December 2024. From 11 September 2026 the reporting duties for actively exploited vulnerabilities and severe incidents apply. From 11 December 2027 the regulation applies in full — from then on every product in scope needs a conformity assessment and CE marking.
    Which products are in scope?
    In principle every product with digital elements placed on the EU market. The CRA distinguishes three tiers: default products (self-assessment possible), important products under Annex III in classes I and II — password managers, VPNs, firewalls, operating systems — and critical products under Annex IV. The higher the class, the stricter the assessment procedure.
    What is an SBOM, and do I really need one?
    An SBOM (software bill of materials) is a machine-readable list of every software component in your product. The CRA requires it in Annex I part II for at least the top-level dependencies. It is what lets you say at all, when a new vulnerability surfaces, whether your product is affected.
    How long must I supply updates?
    At least five years from placing on the market — or for the expected lifetime of the product if that is shorter. The support period must be communicated clearly to the customer before purchase. For many manufacturers this is the most far-reaching change, because it feeds straight into the product costing.
    What happens if we breach it?
    Fines run to up to 15 million euros or 2.5 % of worldwide annual turnover — whichever is higher. On top of that, market surveillance authorities can prohibit sale and order recalls.
    How do the CRA and NIS-2 relate?
    NIS-2 places duties on organisations , the CRA places them on products. If you fall under NIS-2 and also make products, both apply to you. The good news: risk management, supply chain control and the reporting processes can largely be built once for both.
    We buy components in — are we still liable?
    Yes. Whoever places a product on the market under their own name is the manufacturer in the sense of the CRA — even when substantial parts are bought in. You have to review your supply chain, include the components in the SBOM and track vulnerabilities in third-party components yourself.
    How much internal work does this mean for us?
    For a product with a clear scope, reckon on 20–35 person-days on your side — mostly in development and product management. The largest block is the technical documentation, because it has to pull knowledge together from several teams.
    How long does CRA conformity take?
    With our support, typically 6–12 months for the first product. Every further product in the same family goes markedly faster, because the processes, templates and SBOM tooling are then in place. If you already hold ISO 27001 the first run is noticeably shorter.