Question 1

Can I change or cancel my plan at any time?

Accepted Answer

Yes. You can upgrade, downgrade, or cancel from Dashboard → Settings at any time. Changes take effect from your next billing cycle, and the Free tier — including the Free CRA Check — is always available with no card required.

Question 2

What are the CRA product classifications?

Accepted Answer

Products fall into Default, Important Class I, Important Class II, or Critical, based on their cybersecurity risk. Your class determines the conformity route — Default products can self-assess, while higher classes may need enhanced assessment or a notified body.

Question 3

What is an SBOM and why does the CRA require one?

Accepted Answer

A Software Bill of Materials is a machine-readable inventory of every component and dependency in your product. CRA Annex I requires a current SBOM so you can identify and act on vulnerabilities in third-party components. CRAReady generates a CycloneDX SBOM automatically with cdxgen.

Question 4

What is a VEX statement?

Accepted Answer

A VEX (Vulnerability Exploitability eXchange) statement tells your customers whether a known vulnerability in a component actually affects your product — Affected, Not affected, Fixed, or Under investigation — with a justification. CRAReady lets you assign VEX status per finding and export VEX documents.

Question 5

What are the Article 14 incident reporting deadlines?

Accepted Answer

For an actively exploited vulnerability or severe incident you must notify ENISA on three deadlines: an early warning within 24 hours, a full notification within 72 hours, and a final report within 14 days. CRAReady tracks each incident against these deadlines.

Question 6

What is the technical file and Declaration of Conformity?

Accepted Answer

The technical file is the dossier of evidence (product description, risk assessment, SBOM, test results, applied standards) proving you meet CRA Annex I. The EU Declaration of Conformity is your formal signed statement of conformity under Article 30. Both are prepared and stored in CRAReady, linked to the product.

Question 7

What is the EU Cyber Resilience Act (CRA)?

Accepted Answer

The CRA (Regulation (EU) 2024/2847) is EU law that sets mandatory cybersecurity requirements for products with digital elements — hardware and software — sold in the EU. It covers security-by-design, vulnerability handling, an SBOM, and, from 2027, CE marking to signal conformity.

Question 8

Does the CRA apply to my product?

Accepted Answer

If your product has digital elements and can connect to a device or network, and you place it on the EU market, the CRA almost certainly applies — regardless of where your company is based. Pure SaaS without a downloadable component is generally out of scope. Run the Free CRA Check to confirm your status and classification.

Question 9

When do I need to comply?

Accepted Answer

There are two key deadlines: 11 September 2026, when Article 14 vulnerability and incident reporting obligations begin, and 11 December 2027, when full conformity (CE marking, technical documentation, conformity assessment) is required.

Question 10

How does CRAReady generate an SBOM?

Accepted Answer

Upload a source archive or connect a GitHub repository and CRAReady runs cdxgen to enumerate every component and transitive dependency across 200+ ecosystems, producing a CycloneDX SBOM. You can also import an existing CycloneDX or SPDX file you already produce in your build pipeline.

Question 11

Where do vulnerability findings come from?

Accepted Answer

Components in your SBOM are matched against the NVD, OSV, and GitHub Advisory databases, then enriched with CVSS severity, EPSS exploit-probability, and the CISA KEV known-exploited list so you can prioritise what matters most.

Question 12

Do I need an account to use the Free CRA Check?

Accepted Answer

No account is required — just confirm your email. Answer 12 questions and you'll get your CRA scope, product classification, and recommended conformity route, with a branded PDF you can export for your records.

Frequently Asked Questions

Billing

Compliance

General

Product