CRA SBOM keeps track of what is inside every product you sell, warns you when something in it becomes a security risk, and drafts the paperwork the EU will ask for.
Priced per product, not per developer from €59No credit card needed. Set up your first product in an afternoon.
| openssl | 3.0.13 | Fix now |
| linux-kernel | 6.6.30 | Not affected |
| busybox | 1.36.1 | Checking |
| mosquitto | 2.0.18 | OK |
| zlib | 1.3.1 | OK |
| + 212 more components |
If you sell a product with software in it in the EU, the Cyber Resilience Act (CRA) applies to you. That covers apps, connected devices, machines with a control panel, and most things that plug into a network.
The CRA asks two simple-sounding things. Know exactly what your product is made of. And when a security problem shows up in it, act fast and tell the authorities.
A Software Bill of Materials, or SBOM, is an ingredients list for your software. Modern products are built from hundreds of ready-made pieces, many of them free open-source code written by other people. The SBOM lists every one of those pieces and its version, so you can tell at a glance whether a newly discovered problem affects you.
The hard part for a small team is not making the list once. It is keeping it current for every product and every version you have shipped, watching it every day, and producing the right documents when an auditor or a customer asks. Big companies hire a team for that. You probably have a few developers who would rather be building your product.
That is why we built CRA SBOM. It is an online service that does the tracking, the watching and the paperwork for you. You do not need to know anything about SBOMs to use it. You need to know which products you sell.
Each step builds on the last. Most teams finish the first three in one afternoon, and the rest runs on its own.
List the products you sell and the versions your customers are running. When someone asks “is version 2.3 of your gateway affected?”, you have the answer in seconds instead of digging through old folders and emails.
What you get: a clear record of everything you have ever shipped.
Your developers already have an automated process that builds your software after each change, often called CI (continuous integration). Add one short step and every new build sends its ingredients list to CRA SBOM automatically.
What you get: a list that is always current, with no extra work for your team.
You do not have to write an SBOM by hand or buy a separate tool. Free, widely used open-source tools scan your code and produce the list in the standard formats the EU and your customers expect. Our setup guides cover the languages you already use.
What you get: a correct SBOM from day one, at no extra cost, and the files stay yours.
New security problems are found in popular components every day. CRA SBOM checks your products against public vulnerability databases around the clock and alerts you with the product, the version and how serious it is.
What you get: you hear about problems before a customer or a regulator tells you.
Not every alert means your product is at risk; often the vulnerable part is never used. VEX (Vulnerability Exploitability eXchange) is a simple way to record your verdict: affected, not affected, fixed, or still checking, with the reason.
What you get: clear answers for customers, and proof that you checked.
When a security hole in your product is being actively exploited, Article 14 of the CRA starts a clock. CRA SBOM pre-fills each report with the affected products, versions and what you have done so far. You review, adjust and send.
What you get: deadlines met, even when the alert lands on a Friday evening.
Before you put the CE mark on a product, the CRA expects you to keep a technical file: the documents that show how you meet the rules. CRA SBOM exports the software side of that file, including SBOMs, vulnerability decisions and report history, as a tidy package for an auditor or a notified body.
What you get: hours of document gathering turned into a download.
The CRA counts products, so we do too. You pay for each product you put on the EU market. How many people work on it is up to you.
Most security tools were built for large software companies. They charge for every developer, often around $1,000 per developer per year, and the bill grows every time you hire.
Your first CRA product, or a single-product business.
Start freeA small product range with regular releases.
Start freeManufacturers with a wide catalogue of devices or apps.
Talk to usEvery plan includes unlimited users, unlimited versions, daily monitoring, VEX decisions, Article 14 report drafts and technical-file export. Prices exclude VAT. Pay yearly and get 2 months free. Every plan starts with a 30-day free trial.
Per-developer estimate uses about $1,000 (≈ €900) per developer per year, a typical quote for developer-security platforms. CRA SBOM uses list prices billed monthly.
If you sell a product in the EU that contains software and can connect to a network or another device, it very likely does. Some sectors, such as medical devices and cars, have their own rules instead. During your trial we walk through it with you.
Not at all. Most of our customers start from zero. The free generators create the list for you, and our setup guide takes you through the first product step by step.
No. They add one step to the build process they already have. After that, everything runs in the background.
No tool can do that alone. The CRA also covers how you design and support your product. CRA SBOM takes care of software tracking, vulnerability handling and reporting, the part most small teams find hardest to keep up with.
One product is one thing you sell under one name, with all of its versions. A gateway sold in three hardware variants with the same software is one product.
Yes. Your SBOMs and records use open, standard formats and you can export them at any time.
Short, plain answers to what people ask most about the EU's new cybersecurity law for products.
CRA stands for the Cyber Resilience Act, officially Regulation (EU) 2024/2847. It is the European Union law that sets cybersecurity rules for products that contain software or connect to a network. It entered into force on 10 December 2024.
The CRA is the first EU-wide law that makes cybersecurity a condition for selling a product in the EU. It covers “products with digital elements”: hardware and software that can connect to a device or a network, from smart cameras and routers to desktop and mobile apps.
Manufacturers must design products to be secure, fix vulnerabilities for the product's support period (usually at least five years), keep an SBOM, and report actively exploited vulnerabilities. Its obligations arrive in three steps:
Breaking the core rules can cost up to €15 million or 2.5% of worldwide annual turnover, whichever is higher.
EU CRA compliance means your product meets the essential cybersecurity requirements in Annex I of the regulation, and you can prove it. In practice that means:
CRA SBOM covers the SBOM, vulnerability monitoring, reporting and documentation parts of this list.
In European product and cybersecurity compliance, CRA almost always means the Cyber Resilience Act. The same letters have other meanings elsewhere: in the United States, the Community Reinvestment Act is a banking law; in Canada, CRA is the Canada Revenue Agency; and in clinical trials, a CRA is a Clinical Research Associate. If your question is about selling connected products or software in the EU, it is the Cyber Resilience Act.
A conformity assessment is the check that shows a product meets the CRA's requirements before it gets the CE mark. Which check you need depends on the product's risk category:
| Category | Examples | How it is assessed |
|---|---|---|
| Default | Most products, such as smart speakers, printers, games and most apps | Self-assessment by the manufacturer (internal control) |
| Important, class I | Password managers, VPNs, routers, operating systems, smart locks and security cameras | Self-assessment if you fully apply a harmonised standard, otherwise a notified body |
| Important, class II | Firewalls, intrusion detection systems, hypervisors, tamper-resistant chips | Third-party assessment by a notified body |
| Critical | Smart meter gateways, smartcards, hardware security boxes | May require European cybersecurity certification |
Whatever the route, you end with a technical file, an EU declaration of conformity and the CE mark. Around 90% of products are expected to fall in the default category, where you assess the product yourself.
Each law covers a different target. The CRA is the one about the products you sell.
| Law | Who or what it covers | Applies from |
|---|---|---|
| Cyber Resilience Act (CRA) | Products with digital elements sold in the EU | 2026 to 2027, in steps |
| NIS2 Directive | Organisations in essential and important sectors, such as energy, health, transport and digital services | October 2024, through national laws |
| DORA | Banks, insurers and other financial entities, and their key IT providers | January 2025 |
| Cybersecurity Act | ENISA's mandate and the EU cybersecurity certification schemes | June 2019 |
| Radio Equipment Directive, cybersecurity rules | Wireless and internet-connected devices | August 2025, until the CRA takes over |
| GDPR | Security of personal data | May 2018 |
The full rules arrive in December 2027. Set up your first product today and know exactly what is inside everything you sell.
Questions? Write to hello@crasbom.com and a real person will answer.