Cybersecurity
EU Cyber Resilience Act (CRA) Compliance Consulting
We support CRA compliance for products sold in the EU, from applicability assessment to SBOM, vulnerability management and technical documentation.
We support CRA compliance for products sold in the EU, from applicability assessment to SBOM, vulnerability management and technical documentation.
Why You Need This
Cybersecurity Is Becoming a Condition for Selling Digital Products in the EU
Is your product within the scope of the CRA?
In principle, the CRA applies to products with a data connection to a device or network that are placed on the EU market. Motor vehicles and components designed exclusively for them are excluded, but general-purpose components, robots, agricultural machinery and construction machinery may be in scope.
Do reporting obligations cover products already on the market?
Since 11 September 2026, manufacturers must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident having an impact on the security of the product. This also applies to products already placed on the EU market.
What must be in place by December 2027?
From 11 December 2027, products placed on the EU market must meet the essential cybersecurity requirements and go through technical documentation, conformity assessment and an EU declaration of conformity before the CE marking is affixed. For devices, placing on the market is assessed unit by unit, so units of a model already on sale that are placed on the market after that date are also covered.
Service Introduction
SeonENS CRA Consulting
Drawing on our ISO/SAE 21434 cybersecurity and functional safety experience, we support you from preparation before release to vulnerability management after release.
CRA Applicability Assessment
We determine whether the CRA applies, the product class and your company's role, such as manufacturer or importer, and set out the support period and what needs to be prepared.
Security Development System
We establish risk assessment, vulnerability handling and reporting procedures, and define contract clauses for suppliers. If you already have an ISO/SAE 21434 system, we build on it.
SBOM and Vulnerability Management
We identify dependencies obtained through package managers as well as open source copied into your source code, create an SBOM for each product, and keep checking for new vulnerabilities after release.
Technical Documentation and Declaration of Conformity
We help prepare the technical documentation and EU declaration of conformity required by the CRA, and support notified body assessment for products that require third-party conformity assessment.
Service Areas
CRA Service Offering
Conformity Preparation Consulting
- Applicability assessment, gap analysis
- Security development process, reporting procedures
- Technical documentation, EU declaration of conformity
SBOM and Vulnerability Management
- SBOM creation for each product
- Pre-release vulnerability and secure coding checks
- Post-release vulnerability monitoring
CRA Training
- Overview course: applicability, timeline, obligations
- Practical course: risk assessment, technical documentation, SBOM exercises
- In-house training for your organization
CRA Requirements and Our Support
| Requirement | SeonENS Support |
|---|---|
| Risk-based security design | Risk assessment, derivation of security requirements |
| Vulnerability handling and SBOM | SBOM creation, vulnerability handling and disclosure policy |
| Support period (in principle at least 5 years) | Support period determination, post-release vulnerability management |
| Reporting of actively exploited vulnerabilities and severe incidents having an impact on the security of the product | Criteria for what to report, reporting procedures including the 24-hour early warning |
| Technical documentation, conformity assessment | Support for technical documentation and the EU declaration of conformity |
Is Your Product Within the Scope of the CRA?
| Product | CRA Application |
|---|---|
| Motor vehicles and their trailers (categories M, N, O) and components designed exclusively for them | Excluded |
| L-category vehicles (two-wheelers etc.) and components designed exclusively for them | Excluded (except L1e vehicles designed to pedal) |
| General-purpose components used in various types of products | In scope |
| Components not exclusive to vehicles, sold through open channels such as retail or online | In scope |
| Robots (excluding medical devices), agricultural machinery, construction machinery, industrial controllers | In scope if they have a data connection |
| Chargers and diagnostic equipment sold separately from vehicles | Unlikely to fall under the vehicle exclusion, assessed under the general criteria |
CRA Consulting Process
Phase 1: Applicability Assessment
- Product list, applicability, product class
- Role identification, support period determination
- Gap analysis, response roadmap
Phase 2: System Establishment
- Security development process
- Vulnerability handling, disclosure policy
- Reporting procedures, supplier contract clauses
Phase 3: Product Application
- Risk assessment, SBOM for each product
- Technical documentation
- EU declaration of conformity, assessment support
Phase 4: Post-Release Management
- Vulnerability monitoring
- SBOM updates
- Support in deciding what to report
Expected Benefits
Practical Benefits
- Prepare What You Need First
- We first clarify scope and product class so that you can prepare in line with your release schedule.
- Security and Functional Safety Together
- For machinery such as robots and construction machinery, we also address the EU Machinery Regulation requirements for protection against hacking and tampering.
- Management That Continues After Release
- We keep managing your SBOM and vulnerabilities throughout the support period.
Start Your CRA Response Now
Start Your CRA
Response Now
Tell us which products you sell in the EU and through which channels, and we will propose whether the CRA applies and how to respond.
Tell us which products you sell in the EU and through which channels, and we will propose whether the CRA applies and how to respond.