01
PDE catalogue
Products, versions, markets and placing-on-the-market dates. You see what CRA covers.
Cyber Resilience Act
Product map
Risk
SBOM
Documentation
On-premise
We help manufacturers run product cybersecurity under the CRA.
Product map, risk assessment, SBOM, documentation and vulnerability handling. One system, before the product reaches the Union market.
Scope
CRA is not a vulnerability scanner
Vulnerabilities and the Article 14 clock are one module. The system runs the product map, risk assessment, SBOM, technical file and the CE path.
02
Annex I
Essential requirements pinned to the product, with the risk assessment and gaps.
03
SBOM and components
Ingredients, origin, licences and known vulnerabilities.
04
Vulnerabilities
Handling through the declared support period, with a 24h / 72h clock.
05
Documentation
A technical file ready if a market-surveillance authority asks.
06
CE path
Conformity assessment, EU declaration and marking, before the product leaves the warehouse.
What the first week after install looks like
- 1
Catalogue
Products go in: name, version, type (device / software / component), markets, placing-on-the-market date, support end.
- 2
Scope
On each PDE you mark whether CRA applies, who the manufacturer is, and whether a substantial modification happened.
- 3
Risk and Annex I
The risk assessment is tied to the essential requirements. A gap does not live in a side spreadsheet.
- 4
SBOM
Components from CI or import, linked to CVE. Due diligence on the supplier stays on the component.
- 5
Article 14 and CE
A vulnerability queue with a 24h/72h clock. Technical file, EU declaration, mark - before the product leaves the warehouse.
Who Crado AI is for
- A hardware or software manufacturer placing a product on the Union market under their name.
- An importer who places a non-EU product on the market and picks up manufacturer duties.
- Quality / Product Security / a CTO who needs a technical file, not a slide.
- A 20–250 person company with a PDE catalogue and no 15-person conformity desk.
What this is not
- A SaaS cloud. Deployment is on-premise only.
- A public price list or a buy button.
- A notified body or a law-firm opinion.
- A NIS2, AI Act or DORA module. This system is for CRA.
On-premise only
SBOM, risk assessment and the technical file stay on your network. There is no product cloud and we do not ask you to upload the file elsewhere.
- App and database on your infrastructure (VM or Kubernetes).
- Identity against your IdP (OIDC / SAML).
- Backups and network stay in your standard.
- No tenant in our cloud and no SaaS plan.
Industries
Same regulation, different product
Software
Software sold in the EU is a PDE.
You do not need to ship a device to fall under CRA. An application, a library or an embedded system sold separately is a product with digital elements if you place it on the market under your name.
IoT
The device leaves the factory with a support duty.
CRA wants no known exploitable vulnerability at launch, secure defaults, and updates through a declared period. That hurts more on firmware than on SaaS.
Industrial
A machine with a controller is also a product with digital elements.
A line, a PLC, an HMI, a gateway - if you place it on the Union market as a product, CRA asks about design, components and maintenance. Industrial buyers do not want that file in someone else’s cloud.
Electronics
A CE mark after CRA is more than EMC and LVD.
Cybersecurity becomes a product property next to the older directives. The manufacturer needs a risk assessment, a bill of materials and a support period before the product is placed on the market.
Timeline
The dates that set the pace
- 01
10 December 2024
Entry into force
The regulation is in force. Full application of the essential requirements comes later.
- 02
11 June 2026
Conformity-assessment bodies
The rules on notifying conformity-assessment bodies start to apply.
- 03
11 September 2026
Article 14 notifications
Manufacturers notify actively exploited vulnerabilities and severe incidents: early warning in 24 hours, full notification in 72 hours, then a final report.
- 04
11 December 2027
Essential requirements and CE
A product placed on the market must meet Annex I, complete conformity assessment, carry an EU declaration and the CE mark. Risk assessment, documentation, SBOM and the support period must be maintained.
Knowledge base
CRA resources
Shortcuts to the key parts of the regulation and tools we are adding.
CRA blog
Product map, risk, documentation and the dates from the regulation.
CRA dates
10.2024 entry into force, 09.2026 Article 14, 12.2027 CE mark.
Annex I in short
Essential requirements: product properties and vulnerability handling.
Roles in the chain
Manufacturer, importer, distributor, authorised representative.
The Article 14 clock
Early warning 24h, full notification 72h, final report.
Annex I checklist
SoonA checklist of essential requirements for the technical file.
Support-period calculator
SoonWork out the support end and EOL date for a product.
Questions you will ask anyway
Is Crado AI a vulnerability scanner?
No. Vulnerabilities and the Article 14 clock are one module. The system runs the product map (PDE), risk assessment and Annex I, SBOM, the technical file and the CE path.
Does standalone software fall under CRA?
Yes, if you place it on the Union market under your name or trademark. A PDE is not only a box of electronics.
What happens on 11 September 2026?
Article 14 applies: actively exploited vulnerabilities and severe incidents. Early warning in 24 hours, full notification in 72 hours, then a final report. Through the single platform to the CSIRT of the main establishment and to ENISA.
And 11 December 2027?
Annex I essential requirements, conformity assessment, EU declaration and CE mark when placing on the market. Risk assessment, SBOM, documentation and the support period must already be running.
Is this a cloud?
No. You install Crado AI on your site. The SBOM and the technical file do not land on our server.
Do you replace a notified body?
No. The system collects evidence and runs the process. Conformity assessment stays yours.
How many products can it cover?
From a handful of SKUs to a catalogue in the hundreds. On the call we ask how many PDEs you have and whether an SBOM already comes from the pipeline.
Where do the mock data come from?
A fictional catalogue (Gate-240, Lens OS). It shows interface density, not a customer.
Where does the form go?
To hello@crado.eu. We reply to the address you give.