The Cyber Resilience Act work we do, and what we leave out

You answer a short set of questions about your product and get back a plain reading: whether the law reaches it, which group it falls into, which dates apply to you and what to do first. It runs on published rules rather than on a model, so the same answers always produce the same result, and the reasoning is shown next to the answer.

Nobody calls you afterwards unless you ask. If the rules do not reach your product, they say so, and you have spent two minutes.

You fill in one form in your own time and give us read access to your product documentation. You get back a signed scoping memorandum: whether the law covers each product and version and why, which group it falls into and who has to check your work as a result, the dates that apply to you, how long you should support the product, and the three things to do first. The manufacturer determines the support period so that it reflects the expected time in use; it must be at least five years unless the product is expected to be used for a shorter time.[Art. 13(8), third subparagraph]

If your product falls into one of the stricter groups, we say so and explain what that means for you. Conformity assessment uses the modules in Annex VIII. A default product may use internal control (module A), or, if the manufacturer prefers, EU-type examination with production control (modules B and C), full quality assurance (module H), or a European cybersecurity certification scheme where one is available and applicable. An important class I product must go to a notified body under modules B and C or under module H whenever the manufacturer has not applied, or has applied only in part, harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least substantial — and also where no such standard, specification or scheme exists at all. An important class II product must use modules B and C, module H, or such a certification scheme; there is no internal-control route for it.[Art. 32(1), 32(2), 32(3); Annex VIII] For the shortest list of all, a formal European certificate applies only where the EU has singled the product out; otherwise it is the same outside body as class II. A critical product listed in Annex IV needs a European cybersecurity certificate at assurance level at least substantial, and then only where the Commission has adopted a delegated act saying so for that category, and it can only do that where a certification scheme covering the category has already been adopted and is available to manufacturers; any such act must normally allow at least six months to change over, and may allow less only where urgency justifies it. Where no such delegated act has been adopted, the product follows the class II route instead. We have not established which delegated acts exist today.[Art. 8(1); Art. 32(4)] The chapter that lets the independent bodies exist applies before the main duties do, and the European Commission lists the bodies notified for this law in its NANDO database. The chapter on the notification of conformity assessment bodies applies from 11 June 2026, so that notified bodies can be in place before the main obligations apply.[Art. 71(2); Chapter IV] If you are going to need one, it is much better to know that now than in the last quarter before the deadline.

The fee comes off in full against the three steps up from it — Reporting Ready, the engineer-led gap review and Market Ready — and that credit does not expire. It is the one line on our list with more than one thing to spend it against; everything else is credited against Market Ready. That is Article 9.7 of the agreement, not a sentence on this page.

The first thing you receive is code, not a document. We open one change against your own code that adds four things: a build step that produces a signed list of every component in the product, a check that stops the build when a dangerous component gets in, the small standard file (security.txt) that tells outside researchers where to send a security report, and a note saying how long the product is supported. Your engineers review and merge it. That merged change is the first piece of evidence in your paperwork.

The rest of it delivers:

• a published policy telling outsiders how to report a problem to you, and the person who answers; Manufacturers must put in place and enforce a coordinated vulnerability disclosure policy.[Annex I, Part II, point 5]
• a written plan for what happens when one arrives, keyed to the legal clocks and practised once with your team; The first two filings are due without undue delay and in any event within the outer deadline — the hour figures are backstops, not an allowance to wait. For an actively exploited vulnerability: an early warning without undue delay and in any event within 24 hours of becoming aware, a vulnerability notification without undue delay and in any event within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available.[Art. 14(2)] the plan covers the second path too, a serious incident affecting the product's security, which does not have to be an attack and which has its own test and its own last deadline; An incident that has an impact on the security of the product counts as severe, and so has to be reported, if either of two things is true: it harms, or is capable of harming, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions; or it has led, or is capable of leading, to malicious code being introduced or run in the product or in a user's own systems. Either limb on its own is enough, and "capable of" is enough — the duty does not wait for harm that has already happened. This test is for severe incidents only; it never applies to the vulnerability side.[Art. 14(5)] For a severe incident the first two filings carry the same two-part standard: an early warning without undue delay and in any event within 24 hours of becoming aware, and an incident notification without undue delay and in any event within 72 hours. The final report is due within one month after the incident notification is submitted — the month runs from the filing, not from the 72-hour deadline.[Art. 14(4)]
• the message to your own customers, drafted next to the ones for the authorities, because telling the people the product affects is part of the same duty and not a public-relations afterthought; After becoming aware of an actively exploited vulnerability or a severe incident, the manufacturer must tell the users it affects — and where appropriate all users — about it, and where needed about the steps they can take to limit the damage, in a machine-readable form where that is appropriate. There is no fixed deadline: the standard is that it is done in a timely manner, and if the manufacturer does not, the CSIRT may tell users itself.[Art. 14(8)]
• a written record of who inside your company would act on a warning about the product, and how they are reached.

We work with Python, Node, Java, .NET and Docker, on GitHub Actions and GitLab CI, on one product family in one repository. Anything else we quote separately rather than guess at.

"Ready to report in ten working days" is the target for the core of that list, and the ten days are ours: they do not stop while we wait for a meeting, because there are no meetings in them. We track it day by day and you see the tracker. The dates go into your statement of work, and the contract commits us to reasonable skill and care in meeting them — not to a guaranteed result.

Choosing and configuring the tool that watches your components is a separate job with its own price — see set up your own monitoring below.

We take a read-only copy of your code, run our scanners over it and compare what we find against the law's requirements, one by one. Products must be designed, developed and produced to meet the product cybersecurity requirements in Annex I Part I, and manufacturers must meet the vulnerability handling requirements in Annex I Part II.[Art. 13(1), 13(8); Annex I] You get a plain report of what is missing, with the evidence from your own code beside each item, and a plan in priority order that separates what you need now from what you need before the second date. The raw findings and the component list come with it, so your team can start without us.

Everything you pay for it comes off Market Ready in full, and that credit does not expire — see the package we are not selling yet below for where that leaves you. If you are a smaller firm with one product you do not need this anyway: the package above already tells you where the gaps are.

We compare the monitoring tools that suit your stack and your size and write down which one we would choose and why. We set that tool up in an account you own and pay for, against your own component list, and route the alerts to the people in your company who would actually act on one. We give you a one-off picture of what is vulnerable in your product today, so you know what you are starting from, and one page saying what to do when an alert arrives: who is told, what they check, what the first message says, who sends it, what goes in the log. Then a short recorded walkthrough for your team, the keys, and we step back.

You own the tool and the account from that moment, and from then on you watch your own product on something that keeps working whether or not you ever hear from us again. That is the main reason to do it this way round.

What it is not. We do not watch your product. We are not sent your alerts, we owe you no response time, we run no rota and nobody here is on call, at any hour of any day. We are not a security operations centre and not an incident response service. The tool's own subscription is yours and is not included in our fee. We hold your credentials only while we are setting the tool up and give them back at hand-over. The public sources any tool reads are other people's and can be late or incomplete. You decide whether a weakness is really being exploited, you decide what to report, and you send it. A vulnerability is actively exploited when there is reliable evidence that a malicious actor has exploited it in a system without the system owner's permission. Nothing has to run for that to be true: an authentication bypass, reaching another customer's data, or the use of stolen credentials where a weakness in the product let the attacker obtain or use them, all count, so the 24-hour clock can already be running where no malicious code was involved.[Art. 3(42)] That test is easier to meet than most teams assume, and an attack on the product itself is a second, separate test. An incident that has an impact on the security of the product counts as severe, and so has to be reported, if either of two things is true: it harms, or is capable of harming, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions; or it has led, or is capable of leading, to malicious code being introduced or run in the product or in a user's own systems. Either limb on its own is enough, and "capable of" is enough — the duty does not wait for harm that has already happened. This test is for severe incidents only; it never applies to the vulnerability side.[Art. 14(5)]

If we recommend a particular tool, we take nothing from the company behind it. No referral fee, no commission, no partner status. We put that in writing at the same moment, and the choice is recorded in your decision log as a decision you took on our advice. What we suggest is what fits your product and your team, and there is no other reason for it to be on the list.

It is one fee, once, per unit, and the second and later units cost less, because by then it is the same tool and the same routes with a different component list. What you pay for it comes off Market Ready in full, at what you paid, the same as everything else on our list, and that credit does not expire.

One price for the group, not a price a head, up to that ceiling. What you pay for it comes off Market Ready in full too, and that credit does not expire.