Now CRA reporting has been mandatory since 11 September 2026
Is your product
ready for the CRA?Cyber Resilience Act evidence for connected products and software
The EU now puts a clock on security holes. If attackers use one in your product, you have 24 hours to send the first warning. KROMSE gives you the proof you need: what is inside, what is affected, what you fixed.
KROMSE gives you the evidence. It does not certify compliance. Your team makes the final call.
- days until the CRA applies in full
- 391
- days reporting has been mandatory
- 65
- to send the first warning
- 24 h
Two dates. One is already behind you.
Reporting is mandatory
If attackers are using a security hole in your product, you must report it.
Everything else applies
Every other duty of the Cyber Resilience Act, for products sold in the EU.
- €15 million
or 2.5% of global turnover
That is how high the fines reach.
When a hole is being used, the clock starts.
- 24 hoursEarly warning
- 72 hoursNotification
- 14 daysFinal report
You cannot write that report from memory. You need the evidence ready before the day it happens.
The evidence, ready before you need it.
KROMSE builds it from your code or firmware and keeps it up to date.
What is inside
A full parts list of your product (an SBOM), made from your code or firmware.
Which holes affect it
Every known security hole in your exact versions, ranked by risk.
What was fixed
Each repair, with the change and the date.
How it was checked
The checks every fix passed, in a report your team can review and sign.
KROMSE does not certify compliance and sends nothing to authorities. Your team makes the final call.
One set of evidence. Many rules.
The CRA comes first. The same proof helps with the rest.
- CRA Article 14 reporting
- CRA checklist
- CRA conformity assessment
- CRA vs NIS2
- NIS2
- IEC 62443
- UK PSTI Act
- EU AI Act
- Machinery Regulation
- SBOM
- FDA section 524B
- UNECE R155
Questions about the CRA
- Does KROMSE make my product CRA compliant?
- No tool can do that on its own. KROMSE gives you the evidence the CRA asks for: what is inside your product, which security holes affect it, what was fixed and how it was checked. Your team makes the final call.
- When does the Cyber Resilience Act apply?
- Reporting actively exploited security holes has been required since 11 September 2026. Every other obligation applies from 11 December 2027.
- How fast do I have to report?
- For a security hole that attackers are actively using, the CRA asks for an early warning within 24 hours, a notification within 72 hours and a final report within 14 days.
- What are the fines?
- Fines under the CRA reach €15 million or 2.5% of global turnover.
- Does KROMSE send reports to the authorities?
- No. KROMSE prepares the evidence and a report draft. It sends nothing to authorities and does not certify compliance.
- Which other rules does the evidence help with?
- The same evidence supports NIS2, IEC 62443, the UK PSTI Act, FDA section 524B for medical devices and UNECE R155 for vehicles. NIS2, IEC 62443 and the PSTI Act have their own guides on this site.
Book a demo.
Tell us what you make. A founder shows you your CRA evidence on a product like yours.
Request a demo
Tell us about your product and what you’d like to see. We’ll contact you to arrange a demo with a product expert.