Free CRA Snapshot
A free CRA assessment is an initial evidence-based picture of one product, not a conformity decision. The Snapshot helps you see what is in your build and what needs attention before you commit to a larger engagement.
What you get.
- Component inventory from the agreed inputs
- Known vulnerabilities grouped by severity
- Matches against actively exploited lists
- Likely product class and classification caveats
- Top ten gaps, next steps and an 8–12-page PDF
What we need from you
A product description, target markets, current release and an SBOM, build output, container or agreed source access. We first agree a one-page authorisation and a safe sharing method.
What is outside the scope
One product, one supplied release and an initial review. No code remediation, full technical file, penetration testing or conformity assessment.
We document assumptions and evidence gaps rather than treating a scan as proof. Every accepted deliverable has an owner and a review step. Your engineers can inspect how findings relate to the release and which decisions still need confirmation.
Learn how this work fits the Cyber Resilience Act, the SBOM requirements and the Article 14 reporting process.
From access to usable evidence.
Set the boundary.
Identify the product family, supported versions, build inputs, data location and authorised access. Agree a named contact and the deliverables before we start.
Build the evidence.
Connect inventory to the release. Check findings with the people who know the code. Record decisions with article references and identify what needs engineering attention.
Make the handover useful.
Review the findings together. Separate verified facts from open questions. Assign owners, next actions and dates so the work survives the next product release.
Before we start.
Who remains responsible for compliance?
The manufacturer remains accountable for classification, conformity decisions, reporting and signing the declaration. We prepare evidence and drafts and help with engineering work.
Can we start without sharing all our source?
Yes. We agree the minimum inputs first. An existing SBOM or build output can be a starting point. If those inputs cannot support a conclusion, we document the limitation and agree what is needed next.
What are the payment terms?
Project work is 50% upfront, with the remainder according to the agreed milestones. Invoices are in EUR, excluding applicable VAT. Subscription scope and billing are agreed before activation.
Do you handle certification or penetration testing?
No. Accredited partner labs carry out testing, and notified bodies handle routes that require their involvement. Their fees and scope are agreed separately.
Let's see what your
product needs.
Start with a free Snapshot. We agree the inputs and authorisation before reviewing your build.