CRA Compliance, Operationalized
The EU Cyber Resilience Act imposes fines of up to €15 million or 2.5% of global turnover for non-compliance. CRATrust automates every requirement: SBOM, vulnerability reporting, CE marking, and documentation.
CRA Compliance Timeline
Free during beta — no credit card required
Built for manufacturers across Europe
The Compliance Gap
The CRA affects 400,000+ companies.
Most are unprepared.
The EU Cyber Resilience Act is the most significant cybersecurity regulation ever imposed on product manufacturers. Its requirements are technical, operational, and legal; and they span the entire product lifecycle.
No automated SBOM generation
CRA requires a Software Bill of Materials for every product. Manual SBOM creation is error-prone, slow, and fails to keep pace with continuous development cycles.
Missed vulnerability reporting window
Article 14 mandates reporting actively exploited vulnerabilities to ENISA within 24 hours. Without automation, compliance teams cannot meet this timeline.
Fragmented compliance documentation
CE marking, conformity declarations, and technical files must be maintained and auditable. Most organisations lack a centralised compliance system.
Platform Modules
CRATrust covers every CRA requirement
Seven integrated modules map directly to CRA obligations. One platform. No gaps.
SBOM Manager
Generate, store, and maintain Software Bills of Materials in CycloneDX and SPDX formats. Automatically updated on every build.
Vulnerability Monitor + VEX
Continuous scanning against NVD, OSV, and ENISA advisories. Real-time alerts when your components are affected. Generate CycloneDX VEX statements to formally document non-applicability.
CVD policy — required by law, solved in minutes
CRA Annex I Part II mandates a Coordinated Vulnerability Disclosure process for every manufacturer. CRATrust generates your CVD policy, security.txt (RFC 9116), and a public researcher intake form automatically.
ENISA Reporting
One-click 24h / 72h / 14-day reports formatted to ENISA specifications with SRP-aligned JSON export. Never miss a reporting window after September 2026.
Declaration of Conformity — the final compliance gate
Generate your EU Declaration of Conformity with our wizard. Covers product classification under Annex III, applicable standards, Annex V Technical File, and signatory signature.
SDL Evidence Store
Store pen test reports, threat models, SAST/DAST results, and other security artefacts as structured evidence mapped to Annex I requirements. Automatically populates your Annex V Technical Documentation.
AI Compliance Assistant
Ask plain-language questions about your CRA obligations. Get regulation-grounded answers with article references.
How It Works
Operational in days, not months
CRATrust is designed to integrate with your existing development workflow with minimal friction.
Connect your repositories
Integrate CRATrust with your CI/CD pipeline in minutes. We support GitHub, GitLab, Bitbucket, and Jenkins. Your SBOMs are generated automatically on every release.
Monitor and receive alerts
Our engine continuously monitors your component inventory against global vulnerability databases. When a threat is detected, you receive a structured alert with CRA Article references and recommended actions.
Report and stay compliant
Generate ENISA-formatted reports, maintain your technical documentation, and track your CE marking status, all from a single dashboard. Audit exports available at any time.
Full platform access.
Free during beta.
CRATrust is in active beta. Every feature is free to use until paid plans launch in Q4 2026, giving you time to build your compliance programme before the September deadline.
Join Free BetaNo credit card. No commitment. Beta users receive an early adopter rate when paid plans launch.
Everything included in beta
- SBOM generation: CycloneDX & SPDX formats
- Continuous vulnerability monitoring
- One-click ENISA reporting
- CE Marking Navigator
- Documentation Centre
- AI Compliance Assistant
Beta price
Until Q4 2026
€0
Free
FAQ
Frequently asked questions
The September 2026 deadline is not optional.
Over 400,000 companies must comply. Market surveillance authorities across the EU will begin enforcement. Start your compliance programme now, before the deadline becomes a crisis.
CRATrust is free during beta. No credit card. No commitment.