CRA AppSoftware for the EU Cyber Resilience Act (Regulation (EU) 2024/2847)
Cyber Resilience Act · Mandatory reporting since 11 Sep 2026
Classify. Prepare. Report.
Since 11 September 2026, manufacturers placing products with digital elements on the EU market must report actively exploited vulnerabilities and severe incidents within 24 hours, and from 11 December 2027 the CRA applies in full. CRA App determines, product by product, the obligations that apply and the documentation that must be in place.
Per reference
scope, role, category, conformity route, support and priority for every product
Smart decision tree
the 14 CRA steps applied with a single criterion across the whole portfolio
24 and 72 hours
Article 14 deadlines, with date calculation and incident scope per layer
Web app
available 24/7 from any browser, with Excel import and export
CRA conformity is demonstrated product by product
Every product placed on the market requires its own risk assessment, technical file, EU declaration of conformity and CE marking. The reporting obligation has applied since 11 Sep 2026.
Deadlines in force
Article 14 reporting applies from 11 Sep 2026, including products placed on the market earlier. The essential requirements and CE marking apply from 11 Dec 2027.
Portfolios with shared components
Software, communications, cybersecurity and cloud services shared by many products. Without a dependency map, effort is duplicated across technical files and the risk of omissions increases.
The category determines the conformity route
Default, important class I or class II, or critical product. The category determines whether self-assessment is sufficient or a notified body must be involved.
A demanding penalty regime
Fines of up to €15M or 2.5% of total worldwide annual turnover for non-compliance with the essential requirements or the reporting obligation.
What the Regulation sets
24 hours
early warning of an actively exploited vulnerability or a severe incident
72 hours
vulnerability or incident notification; for incidents, with an initial assessment
5 years
minimum support period with security updates, unless the expected use time is shorter
11 Dec 2027
full application of the Regulation
Source: Regulation (EU) 2024/2847, Articles 13, 14, 64 and 71.
A single criterion for the whole portfolio
CRA App translates the product catalogue into compliance decisions. Every result derives from an explicit, auditable rule, and every input can be adjusted.
Classification per reference
Scope, role (manufacturer, importer, distributor), conformity unit, category, conformity route, applicable standards, support and priority.
Dependencies and inheritance
Which layers of the shared platform each product uses, whether each dependency is essential or optional, and which Annex I controls it inherits, shares or addresses on its own.
Article 14 reporting
Calculation of the 24-hour, 72-hour and final report deadlines, and incident scope: affected references and Member States.
Annex I requirements
Essential requirements matrix per reference, distinguishing what the platform provides from what each product must address.
Risks and consistency
Automatic alerts on incomplete data, categories pending confirmation, essential dependencies with a shorter support period and suppliers without a notification clause.
Roadmap
Obligations per role, with their status and timeline up to 11 Dec 2027, product by product.
From product inventory to the EU declaration of conformity
A continuous process on a single database. Each phase reuses the results of the previous one, and the official documentation is drafted from data that has already been verified.
- 01
Inventory and scope
Loading of the product tree and the shared layers: software, communications, cybersecurity and cloud services.
CRA scope defined
- 02
Classification
A 14-step decision tree per reference: scope, role, Annex III and IV category and conformity assessment route.
Record per reference
- 03
Risks and requirements
Risk assessment and application of the Annex I essential requirements, with control inheritance across layers.
Requirements matrix
- 04IA
Advanced AI generator
Drafting of the official documentation from the data of the previous phases, referencing the evidence behind each section.
Traceable drafts
- 05
Review and signature
Your technical and legal teams review, complete and approve. The manufacturer signs the EU declaration of conformity and affixes the CE marking.
Approved technical file
- 06
Reporting and maintenance
Article 14 procedure, vulnerability handling throughout the support period and documentation updates for every change.
Sustained conformity
Documentation ready for official submission, built on your data
The generator drafts each document with the structure required by Regulation (EU) 2024/2847 and feeds it with the classification, risk assessment and evidence recorded in CRA App. It does not start from generic templates: every section refers back to its source data and evidence.
How it works
- Traceability: every statement links to the requirement, data and evidence behind it.
- Consistency: shared content is written once and inherited by each technical file.
- Gap detection: it flags sections without sufficient evidence before review.
- Version control: every change to a product or a shared layer identifies the documents to update.
- Drafting in Spanish and English, with export to editable formats.
Documents it drafts
- Technical documentationAnnex VII
- EU declaration of conformityAnnex V
- Simplified EU declaration of conformityAnnex VI
- Information and instructions to the userAnnex II
- Cybersecurity risk assessmentArt. 13
- Coordinated vulnerability disclosure policyAnnex I, Part II
- Early warning, notification and final reportArt. 14
The generator prepares the documentation; review, approval and signature rest with the manufacturer, who is responsible for the EU declaration of conformity under Article 28 of the Regulation.
From your catalogue to a CRA roadmap, in five weeks
A kick-off project led by BeAI on the application itself, with a single point of contact within your organisation.
Portfolio and perimeter
Weeks 1 and 2We load your current and target product tree, define what falls within the scope of the CRA and put the Article 14 reporting procedure into operation.
Classification and gaps
Week 3We classify every reference: role, category, conformity route, dependencies and control inheritance. We deliver a gap report per layer and per product.
Roadmap
Weeks 4 and 5We define the actions up to 11 Dec 2027 per product and per layer, and deliver the technical file template, the complete reporting procedure and the change management rule for the shared platform.
5 weeks
from catalogue to roadmap
2 weeks
to put the reporting procedure into operation
500
references supported by the workbook, without modifying formulas
1
single point of contact in your organisation
Address once what all your products share
Shared elements are documented once and each product reuses them in its technical file. CRA App identifies what each reference inherits.
Shared documentation base
Vulnerability handling, coordinated disclosure, SBOM, updates, secure development and the reporting procedure are documented once for the whole portfolio.
Incremental technical files
Each product refers to the shared base and documents only its own elements: risk assessment, SBOM, tests, support and instructions.
Changes under control
Every change to a shared layer identifies the products and technical files affected.
An obligation in force, including for products already on the market
Since 11 Sep 2026, manufacturers report actively exploited vulnerabilities and severe incidents in their products through the ENISA Single Reporting Platform, including products placed on the market before the CRA.
24 hours
early warning
72 hours
notification
Final report
14 days after a corrective or mitigating measure is available (vulnerability) or 1 month after the notification (incident)
Deadline calculation
The application calculates the early warning (24 hours), notification (72 hours) and final report dates from the moment the manufacturer becomes aware of the event.
Incident scope
When the issue affects a shared layer, the application identifies the references that depend on it and the Member States where they are marketed.
Readiness per product
The application checks, per reference, the point of contact, the coordinating CSIRT, the Member States and the user information channel, and flags those not yet ready.
CRA App prepares and documents the report, which is submitted through the ENISA Single Reporting Platform.
From reading the Regulation to a decision per product
Instead of a generic list of requirements, a well-founded decision for each product.
| In-house spreadsheet or checklist | CRA App | |
|---|---|---|
| Classification rule | Interpreted product by product | 14-step tree with a single criterion for the whole portfolio |
| Shared platform | Each technical file documents it again | Control inheritance per reference and per layer |
| Dependencies | Limited visibility | First and second level graph, essential or optional |
| Article 14 | Written procedure, without deadline calculation | Deadline calculator and incident scope |
| Consistency | No systematic verification | Alerts for incomplete data and categories pending confirmation |
| Formats | A single format | Web and Excel with the same engine |
| Support | Self-managed | Five-week kick-off project with BeAI |
Grounded in the Regulation in force
CRA App is based on Regulation (EU) 2024/2847 and its implementing acts, with an explicit review date.
| Instrument | What it sets | Status in CRA App |
|---|---|---|
| Regulation (EU) 2024/2847 (CRA) | Essential requirements (Annex I), obligations per role, categories, conformity assessment, reporting, penalties | Applied |
| CRA Article 14 | Reporting of actively exploited vulnerabilities and severe incidents from 11 Sep 2026 | Applied: calculator and procedure |
| CRA Annexes III and IV and Implementing Regulation (EU) 2025/2392 | Important products (class I and class II) and critical products, with their technical description | Applied in the decision tree |
| CRA harmonised standards (CEN, CENELEC and ETSI) | Presumption of conformity. None cited in the Official Journal at the review date. Meanwhile: IEC 62443-4-1 and 4-2 and EN 18031 as reference | In preparation |
| Machinery Regulation (EU) 2023/1230 | Cybersecurity requirements for machinery | Identified per reference |
| Directive (EU) 2022/2555 (NIS2) | Obligations of customers that are essential or important entities | Customer context |
CRA App is a classification and preparation tool. It does not replace legal advice or the involvement of a notified body, and the EU declaration of conformity is the manufacturer's responsibility.
For those who manufacture, import or distribute products with digital elements
From manufacturers with hundreds of references to importers with a single product.
Industrial and OT equipment manufacturers
Automation, drives, electrification and control systems with software and connectivity.
Device and software manufacturers
IoT devices, gateways, mobile apps and software sold as a product.
Machinery manufacturers
Connected machinery subject to both the CRA and the new Machinery Regulation.
Importers and distributors
They must verify the manufacturer's compliance before placing the product on the market or making it available.
CRA App is a fit if your organisation
- Places products with software or connectivity on the EU market.
- Manages a broad portfolio, or products that share software, communications or cloud services.
- Needs to determine which products may use self-assessment and which require a notified body.
- Does not yet have an operational 24-hour reporting procedure.
- Requires a plan per product up to 11 Dec 2027.
Does your case have other particularities? Contact us
CRA App features
All features are available and can be seen in a demonstration. SBOM import and API submission to ENISA are enabled on request, in consultation with BeAI.
| Feature | Status |
|---|---|
| Classification per reference, dependencies, Annex I inheritance, risks, actions, roadmap | Available |
| Article 14 reporting: deadline calculator and incident scope | Available |
| Layer graph and walkthrough of a reference in 2D and 3D | Available |
| Excel export and import with the same engine | Available |
| Interface in Spanish and English | Available |
| Multi-user with a permanent database and access control | Available |
| Advanced AI generator for the technical file and the EU declaration of conformity | Available |
| SBOM import and matching against vulnerability advisories | Consult BeAI |
| Submission to the ENISA Single Reporting Platform via API | Consult BeAI |
Frequently asked questions
Does the CRA already apply?
Yes. Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026, including to products placed on the market earlier. The rest of the Regulation, including the essential requirements and CE marking, applies from 11 December 2027.
What about products already installed?
They do not need to be brought into compliance or CE marked, but their actively exploited vulnerabilities and severe incidents must be reported. Products still placed on the market from 11 Dec 2027, even earlier models, and products that undergo a substantial modification must comply with the CRA in full.
Can a shared platform be certified once for all products?
Conformity is declared for each product placed on the market. Shared elements are addressed once: processes, controls and evidence that each technical file then reuses. CRA App identifies what each product inherits.
Is a notified body required?
It depends on the category. Default products may follow self-assessment (module A). Important class I products may as well, provided harmonised standards, common specifications or European certification are applied in full; otherwise, and in every case for class II, a notified body or a European certification scheme is required. Critical products may be required to obtain certification. CRA App applies this rule to every reference.
Does it replace legal counsel or the notified body?
No. CRA App is a classification and compliance preparation tool. The EU declaration of conformity is the manufacturer's responsibility and, where the CRA requires it, a notified body is involved.
Where is the data stored?
In the application's own database, with multi-user access and permission control, which can be deployed on your infrastructure.
Is it compatible with Excel?
Yes. The application imports and exports the same classification workbook, and its engine has been validated cell by cell against it.