The typical client
An SME from Germany, Austria or Switzerland with 10 to 250 employees that offers its own software or connected devices on the EU market: machinery and plant engineering, controls, sensors, building technology, or industry software installed at the customer. There is no in-house security team, and the CRA question comes from sales or from a large customer.
What the CRA requires
Since 11 September 2026 the reporting obligation applies: an early warning within 24 hours, a notification within 72 hours and a final report, including for products already on the market. From 11 December 2027 the product obligations follow: security by design and by default, no known exploitable vulnerabilities at release, security updates over a declared support period, a software bill of materials (SBOM), a vulnerability disclosure policy, conformity assessment and the CE mark.
What you have after two weeks
The classification of your product and its assessment route: self-assessment or notified body. An SBOM of your current release in CycloneDX and SPDX, matched against known vulnerabilities. A gap analysis against Annex I with a finding and evidence for every requirement. A rehearsed 24- and 72-hour reporting process, a disclosure policy with security.txt ready to publish, and an action plan to December 2027 with fixed prices.
Checked with tools we run ourselves
We check with the same supply chain our own platform runs on. Every package and every image is scanned with Trivy and Grype, SBOMs are produced in CycloneDX and SPDX, and new package versions are released only after a waiting period. Renovate keeps dependencies current, Kubescape checks operations against security baselines, and our security.txt is live. We track the findings in ClearSky, with severity, owner and status.
Two weeks, two meetings
Day 1: kick-off
90 minutes on product, markets and supply chain. Result: the classification of your product.
Days 2 to 8: analysis and reporting process
SBOM from your release, matching against known vulnerabilities, gap analysis against Annex I, draft and rehearsal of the reporting process.
Days 9 and 10: handover
90 minutes on all results and the action plan to December 2027.
Frequently asked questions
Does the CRA apply to us as a Swiss company?
Yes, if you offer a product with digital elements in the EU. What counts is the market, not the company seat. For companies in Germany and Austria it applies anyway.
We are a small company. Is there any relief?
Micro and small enterprises are not fined for missing the 24-hour deadline. All other obligations apply unchanged.
Are pure cloud services covered?
Pure SaaS with no delivered product usually is not. If a cloud function belongs to your product, such as controlling a device, it is covered too. We settle that on day one.
Does the check replace the conformity assessment?
No. We are not a notified body and do not give legal advice. We prepare you so that the assessment holds no surprises.