Free intro call
A free 30-minute call to confirm scope, understand your product, and agree on the plan.
CYBER RESILIENCE ACT · EMBEDDED & IOT
Get your embedded product ready for the Cyber Resilience Act.
A fixed-scope pilot for one product. You work in your own environment — your documents and code never leave your company. You get a clear CRA checklist for your product and a prioritized action plan.
Why now: CRA vulnerability and incident reporting applies since 11 September 2026. Full requirements apply from 11 December 2027.
OUR OFFER
CRA Readiness Pilot — one product, up to 4 weeks
A focused engagement to take your first concrete steps toward CRA readiness. Your documents and code never leave your company: you answer a guided questionnaire in your own environment, and we turn your answers into an AI-assisted, expert-reviewed assessment.
How the pilot works
Questionnaire
We send a questionnaire tailored to your product, with guidance for AI tools. You answer in your own environment and note where the evidence for each answer lives (a file or a section).
Analysis
We assess each CRA requirement against your answers. AI-assisted, reviewed by an expert.
Report & read-out
You receive the checklist, evidence overview, and action plan, and we walk you through them.
No evidence, no rating. Each answer says where its evidence lives in your documents or code. If you can't point to evidence, the requirement is marked Missing evidence — never guessed.
What you receive
CRA checklist for your product
Every CRA security requirement, each rated Covered, Partial, Missing evidence, or Not applicable.
Preliminary product classification
Default, important, or critical — with the reasoning behind it.
Evidence overview
What evidence exists, where it lives, and what is missing.
Prioritized action plan
Tasks with a priority, an effort size (S, M, or L), and a suggested owner role.
Scope
Included
- One product (one version or variant)
- Tailored questionnaire and guidance for AI tools
- Expert-reviewed analysis of your answers
- Written report and a 60-minute read-out
Not included
- Certification or conformity assessment
- Legal advice
- Implementing fixes or penetration testing
- Critical-class products beyond classification
What you'll need
Access to your product's security and architecture documentation, an SBOM (SPDX or CycloneDX), and a description of the product and its update mechanism — all in your own environment. Test or pentest results help too. You send us only your answers; we never need access to your repository or documents.
Request a Pilot →FAQ
Common questions
Is this a CRA certification?
No. The pilot assesses readiness. It is not a conformity assessment, and we do not declare products "CRA compliant".
Do we have to share our documents or code?
No. Everything stays in your environment. You send us only your answers to the questionnaire, including where the supporting evidence lives and short excerpts where needed.
Do you use AI?
Yes. Our analysis is AI-assisted and every finding is reviewed by an expert. You can use AI tools to answer the questionnaire, but you don't have to.
What if my product is in the critical class?
We classify it and tell you what that means for your next steps. Mandatory EU certification itself is outside the pilot.
What does it cost?
A fixed fee per product, agreed before the pilot starts.
What happens after the pilot?
You keep the report and the action plan. Any follow-up is optional and agreed separately.
GET STARTED
Start with one product.
Tell us about your embedded or IoT product and the challenges you're facing with CRA readiness.
We'll reply to propose a free 30-minute intro call to see whether the pilot is the right starting point. No commitment.