Understand the product
- CRA technical readiness assessment
- Product architecture review
- Security risk assessment support
- Support-period process
EU Cyber Resilience Act
Your engineers shouldn’t spend six months figuring out the CRA.
We wire SBOM generation into your CI, set up vulnerability intake and triage, build your reporting workflow, and prepare technical evidence from your code and releases.
CRA Article 14 reporting obligations have applied since 11 September 2026.
Full CRA requirements apply from 11 December 2027. Source
dotgrey.IMPLEMENTATION PATH
- Product
- Risk assessment
- SBOM
- Vulnerability handling
- Remediation
- Technical evidence
- CRA readiness
Product work. Processes. Evidence.
The CRA is not
another policy document.
Product cybersecurity touches what you ship: secure development, software inventories, vulnerability handling, updates, reporting and evidence.
Product security gaps
Secure-by-design requirements can mean changes to architecture, authentication, update mechanisms, dependencies and development processes.
Vulnerability handling
Build a process to identify, remediate and document vulnerabilities, with reporting workflows for reportable vulnerabilities and incidents.
Evidence & documentation
Software inventories, risk assessments and technical evidence need to reflect the product you actually ship.
Engineering time
Interpreting requirements, building processes and collecting evidence competes with product development.
The hard part is implementing it across a real product while your engineers keep shipping.
We don’t just tell you
what’s missing.
We help implement it.
Technical work scoped to your product, delivered through your engineering workflow.
Build security into delivery
- SBOM generation & CI/CD integration
- Dependency & vulnerability monitoring
- Secure development lifecycle improvements
- Security update & patching process
Handle vulnerabilities
- Coordinated vulnerability disclosure process
- Vulnerability handling workflow
- Article 14 reporting workflow
- Ongoing product security operations
Remediate & evidence
- Technical security remediation
- Security-related engineering PRs where appropriate
- Technical documentation preparation
- Evidence package preparation
For legal interpretation, formal conformity decisions or edge-case product classification, we work alongside your legal counsel or specialist regulatory partners.
From product to
CRA-ready engineering operation.
Assess the product. Map the work. Implement the changes. Keep the processes running.
Assess
Review the product, architecture, software supply chain and existing security processes.
Map
Map technical gaps against the CRA requirements relevant to the product.
Implement
Build the missing processes, documentation, automation and technical remediation.
Operate
Continue vulnerability monitoring, evidence updates and product-security operations after implementation.
A FOCUSED STARTStart with a 72-hour
Start with a 72-hour
CRA Technical Readiness Assessment.
€2,500
Credited in full if you continue with a Continent CRA implementation project.
No long consulting engagement required.
For one agreed product and build. The 72-hour window starts at kickoff once build access, dependencies and product details are available.
Working outputs in 72 hours
- A first SBOM generated from your build, with a repeatable generation command.
- A security contact page and product-specific vulnerability disclosure policy, ready for your team to publish.
- An Article 14 runbook naming reporting owners and the CSIRT/ENISA submission route, with 24-hour early-warning and 72-hour notification steps from awareness, plus final-report follow-up.
- A prioritized list of CRA gaps, linked to your product and the evidence still missing.
- A fixed-price proposal for the remaining implementation, with scope, milestones and exclusions.
CRA IMPLEMENTATIONThen we
Then we
fix the gaps.
From €15,000
Typical projects: €15,000–€25,000+, depending on product complexity, architecture and existing security maturity.
Discuss my productScoped to the work your product needs
- Technical remediation
- Security-process implementation
- SBOM automation
- Vulnerability workflows
- Documentation & evidence
- Reporting setup
- Engineering support
- Readiness package
CRA PRODUCT SECURITY OPERATIONSCRA doesn’t end
CRA doesn’t end
after launch.
Vulnerability handling, updates, documentation and reporting continue through the product support period.
From €1,500/month
Ask about ongoing coverageOngoing coverage can include
- Vulnerability & dependency monitoring
- Triage & remediation coordination
- Security update tracking
- Technical documentation maintenance
- Vulnerability disclosure handling
- CRA reporting workflow support
- Periodic evidence updates
Built for product companies.
- Connected devices
- IoT products
- Firmware-driven products
- Devices with mobile apps
- Devices relying on cloud backends
- Commercial desktop software
- Downloadable software products
- Commercial software components
- International manufacturers selling into Europe
Not sure whether your product falls within the CRA?
The assessment includes an initial technical applicability review. Generic standalone SaaS is not automatically covered. Formal legal interpretation should be confirmed with qualified regulatory counsel.
Engineering first.
Technical implementation
We work on the actual product, codebase and security processes, with concrete engineering deliverables.
One accountable project
Assessment, remediation, automation and evidence preparation stay in one workflow.
Built for speed
Focused engagements designed to reduce the burden on internal engineering teams.
FREE RESOURCE
Where do you start with the CRA?
An engineering checklist to review your scope, dependencies, vulnerabilities and evidence. Available in French and English.
A practical first review.
Work through it with your engineering team. Print it or save it as a PDF.
Open the free checklistBefore you
get started.
Scope, timing and the role of technical implementation.
What is the Cyber Resilience Act?
The EU Cyber Resilience Act (Regulation 2024/2847) sets cybersecurity obligations for products with digital elements supplied on the EU market. Scope depends on the product and applicable exclusions. CRA compliance involves both product security and manufacturer processes.
When does the CRA apply?
The main requirements apply from 11 December 2027. Article 14 reporting obligations began on 11 September 2026. Transitional rules and product-specific exclusions can affect applicability.
Are the reporting requirements already active?
Yes. Since 11 September 2026, Article 14 requires manufacturers to report actively exploited vulnerabilities and severe incidents affecting product security. It is not a requirement to report every vulnerability. We help implement triage, escalation and reporting workflows.
Does the CRA apply to SaaS?
Generic standalone SaaS is not automatically covered. Remote data-processing functionality can be included when developed by or for a manufacturer and necessary for an in-scope product to perform a function. Assess each product individually; formal scope questions belong with qualified regulatory counsel.
Can Continent certify our product?
No. Continent is not a notified body or certification authority and does not issue formal CRA certification. We prepare technical work and evidence. Depending on the applicable conformity route, the manufacturer may need an appropriate notified body. We do not guarantee legal compliance.
Do you work with connected hardware products?
Yes. The assessment can cover firmware, companion applications, software dependencies and relevant cloud backends. We agree the product boundaries and required access at kickoff.
Can you implement technical fixes?
Yes, within an agreed scope. Work can include security remediation, CI/CD changes, SBOM automation and engineering pull requests. Your team retains code review and release approval.
What happens after the initial assessment?
You keep the generated SBOM and generation command, security contact page, disclosure policy, reporting runbook and prioritized gap list. We also provide a fixed-price proposal for the remaining implementation, with scope, milestones and exclusions. Your team can continue internally or work with Continent. The €2,500 assessment fee is credited in full against a subsequent Continent CRA implementation project.
How long does an implementation take?
It depends on architecture, product boundaries, existing security maturity and remediation needs. We estimate the timeline after assessment. The 72-hour assessment starts at the agreed kickoff once the required access and materials are available; it is not a full implementation or certification.
Do you replace legal counsel?
No. We focus on technical implementation and engineering evidence. Legal interpretation, formal conformity decisions and edge-case classification should be confirmed with your legal counsel or specialist regulatory partners.
Regulatory references:European Commission CRA summary · Regulation (EU) 2024/2847. Scope and conformity obligations depend on the product.
The CRA, in practice.
Practical guides to implementing your workflows and technical evidence.
A CRA implementation roadmap for product engineering teams
Turn CRA readiness into engineering tasks: product boundaries, security controls, SBOMs, reporting owners and release evidence.
SBOM in CI/CD: produce an inventory from the software you ship
A practical SBOM integration guide: choose build inputs, generate a machine-readable inventory, validate coverage and retain release evidence.
CRA Article 14 reporting: turn 24h and 72h deadlines into a runbook
Prepare CRA reporting owners, awareness timestamps, escalation paths, the ENISA reporting platform and final-report follow-up.
A vulnerability disclosure policy your product team can operate
Define a usable security contact, product scope, report requirements, acknowledgement process and coordinated disclosure workflow.
CRA technical documentation: build evidence from each release
Organise CRA engineering evidence around product versions, risk decisions, SBOMs, security tests and remediation records.
Does the CRA cover your SaaS or connected product? Start with the boundary
A technical scoping worksheet for software, firmware, companion apps and remote processing under the Cyber Resilience Act.
Don’t leave CRA implementation
until the deadline becomes
an engineering emergency.
Start with a generated SBOM, a disclosure policy ready to publish and an actionable reporting runbook. In 72 hours from agreed kickoff, get your first controls in place and a fixed-price proposal for the remaining work.