CRA reporting software
Clocks, pre-filled reports and a record of what your representative submitted.
Get ready for the Cyber Resilience Act, starting with the 24-hour warning
We build CRA reporting software for the Cyber Resilience Act. On a delivery date agreed in writing, your team will know who decides, what to send at 24 and 72 hours, and will have practised it once on your own product. That rule has applied since 11 September 2026, including to products you already sell. The decision to report stays with you. We set up how.
Checked against the regulation on 16 Oct 2026 · What changed
Book a free 30-minute callOne fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.
Start here: Article 14 Ready
On a delivery date agreed in writing, your team will know who decides, what to send at 24 and 72 hours, and will have run one practice drill. The scope and the price are fixed in writing before we start, and the work happens in your own tools.
- Runbook Who notices, who decides, who submits.
- Who-decides sheet Roles, backups and hours.
- Checklist The stages in ENISA's order.
- One drill On sample data, with your team.
When a report is due
On the day an exploited bug is reported: your on-call engineer opens one runbook, the named decider is reachable, and the early-warning draft is already structured to match the fields in ENISA's published platform guidance.
Learn
The CRA in plain words
What the CRA is
The Cyber Resilience Act, Regulation (EU) 2024/2847, is a European Union (EU) law that makes cybersecurity a condition for selling hardware and software products in the EU. It entered into force on 10 December 2024.
Who it applies to
- Anyone who places a product with digital elements on the EU market, wherever the company is based: connected devices, firmware, and standalone software such as desktop apps, mobile apps, installable tools and commercially sold plugins.
- Manufacturers carry most of the duties. An importer or distributor that sells under its own brand, or substantially changes a product, takes on the manufacturer's duties.
- A product's cloud back end is covered when the product needs it to work.
- Pure SaaS that isn't the back end of a product is generally out of scope. So is free, non-monetised open source.
- Some products with their own EU rules are excluded, such as medical devices, motor vehicles and aviation products.
Not sure if you're in scope? That's the first thing we check on the call.
Timeline
When the Cyber Resilience Act applies
| Date | What applies |
|---|---|
| 10 Dec 2024 | The CRA enters into force |
| 11 Jun 2026 | Rules for notified bodies (third-party assessors) apply |
| 11 Sep 2026 | Article 14 reporting applies to all products on the EU market |
| 11 Dec 2027 | Everything else: security requirements, documentation, conformity assessment and CE marking |
Products already on the market before 11 December 2027 must meet the full requirements only if they're substantially modified after that date. Reporting applies to them anyway.
Penalties
Fines go up to €15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaching the core security requirements or the Article 13 and 14 duties. Authorities can also order products withdrawn or recalled. Micro and small companies aren't meant to be fined for missing only the 24-hour early warning, but the duty still applies.
Services
Article 14 Ready is the place to start. CRA reporting software is the later desk: clocks, pre-filled reports and a record of what your representative submitted. SBOMs, vulnerability handling and the technical file are each optional.
SBOM and supplier evidence
A bill of materials for every release, and a place suppliers send theirs.
Vulnerability handling
From a report to a written decision, a fix and an advisory.
Technical documentation
Annex I mapped to evidence, before December 2027.
Industries
The same duties land differently if you make connected devices, industrial equipment, consumer electronics, or software you sell.
IoT and connected devices
Firmware, the app and the cloud back end treated as one product.
Industrial equipment
Long support periods, beside the Machinery Regulation.
Consumer electronics
What the buyer is shown at purchase, including the support end date.
Software vendors
Installable software and paid plugins, and where pure SaaS sits.
Seven things a small software company can do this month
- Check whether you're a manufacturer: if you sell or otherwise monetise software in the EU, you very likely are.
- Name the person who would report, and register them on ENISA's Single Reporting Platform.
- Write a one-page reporting runbook: who decides, who submits, what goes in each stage.
- Publish a security contact and a disclosure policy, for example a security.txt file. Our own security.txt is here.
- Produce an SBOM for each release and keep it.
- Set and publish your support period.
- Plan your technical documentation and declaration of conformity before December 2027.
What happens after you book
Day 1
30-minute call. You'll know if we can help.
Same day
Written scope and a fixed price.
Step 1
A staging link, or the first runbook draft, in your tools.
Step 2
You see what changed before the next piece starts.
Launch, then 30 days
We run it with your team once. Code, docs and access are yours. We stay on call for 30 days.
Why a software studio for CRA reporting
Article 14 Ready is a new service. The work under it isn't new to us.
Projects we've worked on include tools that turn a questionnaire into a document an inspector reads, in French and Dutch, and platforms where who can see what is the whole point. A reporting runbook, a who-decides sheet and a deadline clock are the same kind of work, done on your product.
On the call we'll show you a sample runbook built on sample data.
What changed
- 16 Oct 2026. Checked the Article 14 dates and the answers on this site against the regulation.
Questions
Does the CRA apply to us outside the European Union (EU)?
Yes, if you place products on the EU market. Where the company is based does not decide it.
Does it apply to products we already sell?
Reporting does now. The full requirements apply if the product is substantially modified after 11 December 2027.
What's due now and what's due in December 2027?
Article 14 reporting has applied since 11 September 2026. Security requirements, documentation, conformity assessment and CE marking apply from 11 December 2027.
Can you take the reporting duty off us?
No. The decision to report stays with you. We set up who decides, what to send and when. We don't give legal advice or submit reports for you.
Do you submit reports to ENISA?
No. Your named representative submits on ENISA's Single Reporting Platform. We prepare the drafts. The record of what was sent stays in your tools.
Where is our data hosted?
In your own cloud account or hosting. During Article 14 Ready we work from sample data, so we don't need access to production.
Who does the work?
Usama, with a small team. The person on your first call is the person who writes your runbook.
Have you done Article 14 Ready before?
It's a new service, and the first two clients get the SBOM add-on free for that reason. The skills under it come from past builds: questionnaire-to-document tools, multilingual exports and role-based platforms. On the call we show you a sample runbook.
What access do you need?
Your current process, the people involved and somewhere to write the documents. The drill runs on sample data. We don't need production access.
What about our data?
We sign a DPA before you share anything personal. The documents live in your tools, and nothing is kept on our side after handover unless you ask.
What if the CRA doesn't apply to us?
Then we'll tell you on the call, and you won't need us for this.
How many clients do you take at once?
A few. We'll give you a start date on the call, and it goes in the written scope.
Samisoftz builds the process and software your team uses to organise CRA evidence and reporting. You stay responsible for meeting the regulation. We don't give legal advice, act as a notified body, or submit reports for you.
Could your team send a 24-hour early warning tomorrow? Find out in 30 minutes.
You'll talk to Usama, who'd build it.
30 minutes · no slides · a written answer if it's not a fit
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.