Who it’s for

For product development: Security that fits into daily development

With the CRA, security becomes part of the product requirements. Complass keeps them per product and links them with SBOM and vulnerabilities.

Try for free Request a demo

Vulnerability with affected components and assessment in Complass (sample project)

The challenge

Security across the life cycle

It is not only the release that counts: updates, support period and vulnerability handling are part of conformity.

Third-party components

Open source and purchased components bring their own vulnerabilities. Without an SBOM there is no overview.

Short reporting deadlines

Actively exploited vulnerabilities and severe incidents require an early warning within 24 hours.

What the CRA requires of manufacturers

For products with digital elements, among other things:

Frameworks: CRA · Radio Equipment Directive · IEC 62443 · Machinery Regulation

Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant without Complass, consultant with Complass or in-house with Complass? Open the compliance cost calculator

General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.

How Complass helps

CRA per product

Implement requirements per product and version, from risk assessment to technical documentation and CE marking.

More about this feature

SBOM and vulnerabilities

Import the SBOM, find and assess known vulnerabilities of the components, with deadlines up to the update.

More about this feature

Reporting deadlines

Check whether a report under the CRA is required and track the deadlines with a countdown.

More about this feature

Evidence secure development

Document processes for secure development, testing and vulnerability handling, for example according to IEC 62443-4-1.

More about this feature

Vulnerabilities with priority and deadlines in Complass (sample project) — Vulnerabilities per product and version

Matching offers

The Manufacturers industry template preselects the CRA, the Radio Equipment Directive and vulnerability management with SBOM.

available

Industry template: Manufacturers

Cyber Resilience Act per product up to CE marking
Radio Equipment Directive with EN 18031
Vulnerability management with SBOM

from €447 per month plus VAT in the Start package, size S, annual payment

View and order

All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 6 November 2026. Enterprise and groups of companies on request.

Frequently asked questions

Does our product fall under the CRA?

The CRA applies to products with digital elements made available on the EU market, with exceptions for example for medical devices and vehicles. The free check gives a first assessment.

Which SBOM formats are supported?

CycloneDX and SPDX. The components are matched against known vulnerabilities.

How are product development and the company connected?

The CRA concerns your products, NIS2 your company. In Complass you manage both in one account and use shared measures.

White papers: Cyber Resilience Act for manufacturers of hardware and software Secure development for manufacturers

Other job roles and sectors: Manufacturers Software and connected devices Information security and IT All audiences at a glance

Try Complass with your own data

Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.

Try for free Request a demo