Question 1

Does the CRA apply to my product?

Accepted Answer

The CRA covers all ‘products with digital elements’ — i.e. any device that contains software or firmware and is sold on the EU market. A smart lock, temperature sensor, router, machine with a PLC, IP camera — if it has software inside and connects to a network, the CRA covers it. Exceptions include medical devices and automotive products (they have separate regulations).

Question 2

I don’t have an IT department. Can I manage?

Accepted Answer

Yes. CRAready is designed precisely for manufacturers without a security team. You don’t need to understand CVE, CVSS or SBOM formats. Upload the firmware — we do the analysis. You get results in plain language with specific instructions on what to do.

Question 3

I sell a product under my own brand, but someone else writes the firmware. Who is responsible?

Accepted Answer

You are. According to the CRA, whoever places their name or trademark on the product is treated as the manufacturer and bears full responsibility for cybersecurity compliance. Even if the firmware was developed at an OEM factory. That’s why we created binary firmware analysis — you don’t need source code to check what’s in your product.

Question 4

What is an SBOM?

Accepted Answer

SBOM (Software Bill of Materials) is a list of software ingredients — like an ingredients list on a food label, but for the software in your product. It tells you exactly which libraries, components and dependencies are inside. The CRA requires an SBOM in a machine-readable format (CycloneDX or SPDX). This makes it possible to quickly check whether any component has a known vulnerability.

Question 5

What happens if I’m not ready by September 2026?

Accepted Answer

From 11 September 2026 the obligation to report actively exploited vulnerabilities within 24 hours takes effect. No system = no ability to react in time = fines of up to EUR 15 million or 2.5% of global turnover. Additionally, your products may be withdrawn from the EU market. Full compliance with all CRA requirements is required by 11 December 2027.

Question 6

How does this differ from CE marking?

Accepted Answer

The CRA adds cybersecurity to CE requirements. Until now, CE covered physical safety, EMC, chemical substances, etc. Now a new dimension is added: digital product security. In the future, the CE mark will also confirm CRA compliance — your product must be safe not only physically but also digitally.

Question 7

Do I need to do this for each product separately?

Accepted Answer

Yes. Each product with digital elements requires its own SBOM, its own vulnerability analysis and its own technical documentation. If you have 10 different products — you need 10 separate analyses. That’s why our dashboard lets you manage multiple products from one place.

Question 8

Will your tool replace a security consultant?

Accepted Answer

CRAready automates the technical side: firmware analysis, SBOM generation, vulnerability monitoring and report preparation. This eliminates the need to employ a security specialist on a daily basis. However, for more complex matters — e.g. product security strategy, security architecture or audit preparation — a consultant may still be helpful.

Your product contains software? From September 2026 you are responsible for its security.

Why this matters

New EU regulation

Fines up to EUR 15 million

No security department?

Who does the CRA affect?

Smart & IoT device manufacturers

Machinery & industrial equipment manufacturers

OEM / White-Label brands

Consumer electronics manufacturers

Importers of equipment into the EU

Network equipment manufacturers

Everything you need — in one tool

Firmware analysis — no source code needed

Continuous threat monitoring

24h reporting — ready-made forms

Compliance dashboard — like CE marking

How it works

Upload firmware or provide a repository

Learn what’s in your product

Stay compliant on autopilot

Analyze locally. No file uploads.

Pricing

Starter

Pro

Business

Enterprise

Frequently asked questions

Your product. Your responsibility. Our tool.