SBOM per release
Each shipped version needs a bill of materials, so a component question has a version.
Software
Your installable software, ready for the CRA's 24-hour report
If you sell software people install or plugins they pay for, Article 14 applies now. On a delivery date agreed in writing, we set up the process on your product.
Checked against the regulation on 16 Oct 2026 · What changed
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.
Installable software and paid plugins · Seven steps you can do this month · A delivery date agreed in writing
The Cyber Resilience Act for software, plugins and open source
Selling the software is what matters
Where the company is based does not decide it. Placing the product on the EU market does.
Installable tools, desktop apps, mobile apps and commercially sold plugins are products with digital elements. If you sell or otherwise monetise them in the EU, you very likely are the manufacturer, even if you are not based in the EU. Pure SaaS that is not the back end of a product is generally out of scope. So is free, non-monetised open source. A product's cloud back end is covered when the product needs it to work.
The duties that weigh most
An SBOM per release, a disclosure path, updates people can still get, and a declaration they can find.
Disclosure
A policy and a contact that is not only an automated form. Reports need a person.
Updates kept available
Security updates are kept available for at least 10 years after each one is issued, or the rest of the support period, whichever is longer. If users can move to the latest version free, fixes can focus there.
CE marking
CE marking can sit on the declaration or on the website. Only you can sign the declaration.
A first step for a small software company
Seven moves, in an order a small team can do.
Manufacturer
If you monetise software in the EU, you very likely are one.
Who reports
Name them, and register them on ENISA's platform.
Runbook
One page: who decides, who submits, what goes in each stage.
Contact
A security contact and a disclosure policy, such as security.txt.
SBOM
Produce one for each release and keep it.
Support
Set the period and publish it.
The file
Plan the technical documentation and the declaration before December 2027.
If you'd rather do it yourselves
Prefer to do it yourselves? The seven steps above are the list. We're here if you want it done on a delivery date agreed in writing.
Reporting: applies since 11 Sep 2026 · Everything else: 11 Dec 2027 · Full timeline
Related
Questions
How does the price work?
One fixed price for your product, in writing, the same day you ask. It only changes if the scope does.
Do you see our real vulnerability data?
No. The drill runs on sample data. We sign an NDA or DPA before you share anything sensitive.
We already work with a test lab or consultant.
That's fine. We set up the reporting process and they keep the legal and assessment work.
We're outside the EU but sell there.
Article 14 applies to products on the EU market, wherever the maker is based.
Does software we released years ago count?
Yes for reporting. Article 14 covers products already on the market.
Are we in scope as a plugin company?
If you sell or otherwise monetise a plugin in the EU, you very likely are a manufacturer. Free, non-monetised open source is generally out of scope. Pure SaaS that is not the back end of a product generally is too.
Do we patch every old version?
If users can move to the latest version free, fixes can focus on that version. The decision still has to be one you can explain, and the support period is one you publish.
Can we publish betas?
A beta is still software you place on the market if people can get it as a product. Treat it in the same reporting path as the release it will become, and record what you decided.
Samisoftz builds the process and software your team uses to organise CRA evidence and reporting. You stay responsible for meeting the regulation. We don't give legal advice, act as a notified body, or submit reports for you.
On a delivery date agreed in writing, your team will know who decides, what to send at 24 and 72 hours, and will have practised it once on your own product. The decision to report stays with you. We set up how.
Could your team send a 24-hour early warning tomorrow? Find out in 30 minutes.
You'll talk to Usama, who'd build it.
30 minutes · no slides · a written answer if it's not a fit
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.