CRA reporting
Article 14 Ready: CRA reporting, practised on your own product
On a delivery date agreed in writing, we write your reporting runbook on your real product, name who decides, and run one drill with your team on sample data. Scope and price are fixed in writing before we start.
Checked against the regulation on 16 Oct 2026 · What changed
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.
A delivery date agreed in writing · About 4 hours of your engineers' time · English or French · In your own tools
What you'll have
Pages from a sample runbook. Yours is written on your product. The duties themselves are set out in CRA Article 14 reporting, explained.
- A reporting runbook for your real product.
- Who notices, who decides, who submits, and what goes in the early warning, the notification and the final report.
- A who-decides sheet.
- Named roles, backups and hours, so nobody is guessing at 2 a.m.
- A reporting checklist.
- The 24-hour, 72-hour and final stages, set out in the same order as ENISA's reporting platform.
- One practice drill.
- With your team, on sample data, so the first time isn't the real time.
Sample drill report
- Date
- A Tuesday, on sample data
- People present
- On-call engineer, named decider, person who submits
- What was practised
- An exploited bug reported at 09:10
- Gaps
- The backup decider had no second phone on the sheet
- What changed
- The second phone was added before handover
How the work runs
About four hours of your engineers' time, in the sessions marked below, plus someone who can make decisions.
Session with youOur time
Step 1 · Kick-off
How reports reach you today, and who's involved.
60 minutes with youStep 2 · Draft
We draft the runbook and the who-decides sheet in your documents.
Our drafting timeStep 3 · Your review
One call, and comments in the document.
45 minutes with youStep 4 · Practice drill
On sample data, with the people named on the sheet.
90 minutes with youStep 5 · Handover
Final documents, and the gaps the drill showed, fixed.
The documents are yoursStep 6 · Check-in
A later call, to see what the drill didn't cover.
One short call
For you, or probably not
For you if
- You sell connected devices, firmware or installable software.
- A report about an exploited bug would land in someone's inbox today.
- Nobody is named as the person who sends it.
Probably not for you if
- You only run SaaS that isn't the back end of a product.
- You want a notified body to assess the product, or someone to file reports for you.
- You need a full CRA gap assessment. That's a different, bigger job.
Why a software studio for CRA reporting
Article 14 Ready is a new service. The work under it isn't new to us.
Projects we've worked on include tools that turn a questionnaire into a document an inspector reads, in French and Dutch, and platforms where who can see what is the whole point. A reporting runbook, a who-decides sheet and a deadline clock are the same kind of work, done on your product.
On the call we'll show you a sample runbook built on sample data.
Price and ownership
Price
One fixed price for this work. We tell you the number on the call and put it in the written scope. It doesn't change unless you change the scope.
Ownership and languages
Everything is delivered in your own tools and documents, in English or French. We may reuse our own building blocks (for example clock logic and export templates). If we do, you get a licence to use them for as long as you run the software. Everything written for you is yours.
The first two clients
Our first two Article 14 Ready clients get the SBOM-in-your-CI add-on free, in exchange for an anonymous write-up. We never publish your name. The add-on is an SBOM produced for every release in your own CI, kept with its hash.
What can come next
Each step is optional. Nothing starts on its own.
- An SBOM pipeline in your CI
- A small custom reporting and evidence desk
- CRA checklist
- vulnerability disclosure program
- Ongoing support as rules and guidance change.
Questions
Does Article 14 apply to products we launched years ago?
Yes. Reporting covers all products on the EU market.
Do we have to change our tools?
No. We work in yours.
Can it be in French?
Yes. The runbook, the sheet and the checklist can be in English or French.
What happens after handover?
You keep the documents and run with them. If you want help later, an SBOM pipeline, a small reporting desk or ongoing support are separate, optional jobs.
Will we be locked in?
No. You own what we build and where it runs.
Who does the work?
Usama, with a small team. The person on your first call is the person who writes your runbook.
Have you done Article 14 Ready before?
It's a new service, and the first two clients get the SBOM add-on free for that reason. The skills under it come from past builds: questionnaire-to-document tools, multilingual exports and role-based platforms. On the call we show you a sample runbook.
What access do you need?
Your current process, the people involved and somewhere to write the documents. The drill runs on sample data. We don't need production access.
What about our data?
We sign a DPA before you share anything personal. The documents live in your tools, and nothing is kept on our side after handover unless you ask.
What if the CRA doesn't apply to us?
Then we'll tell you on the call, and you won't need us for this.
How many clients do you take at once?
A few. We'll give you a start date on the call, and it goes in the written scope.
Samisoftz builds the process and software your team uses to organise CRA evidence and reporting. You stay responsible for meeting the regulation. We don't give legal advice, act as a notified body, or submit reports for you.
Could your team send a 24-hour early warning tomorrow? Find out in 30 minutes.
You'll talk to Usama, who'd build it.
30 minutes · no slides · a written answer if it's not a fit
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.