We find the gaps, fix them, and get your product compliant with the Cyber Resilience Act — assessment, remediation and ongoing support in one team.
Days 1–2
Applicability, manufacturer role, product & architecture walkthrough
Days 3-7
Prioritized remediation plan, timeline & budget
Days 8-9
Prioritized remediation plan, timeline & budget
Day 10
Findings and plan presented to your leadership
Once you know the gaps, we close them with our engineers alongside yours — turning the roadmap into shipped, evidenced practice. This is where readiness becomes real compliance.
We’ve shipped software under HIPAA, GDPR and ISO 27001 across healthcare, fintech and energy.
We don’t stop at findings — we build the fixes with you end to end.
Security gates and CRA work fit into your existing pipeline and sprint cadence.
You know what you’re getting, when, and for how much.
DevSecOps, penetration testing, and secure SDLC are core practice.
The people who find the gaps can remediate them immediately.
Pure SaaS delivered as a service is generally outside the CRA’s core scope — the regulation targets “products with digital elements” placed on the market. But the line is thinner than it looks: downloadable agents, on-prem or hybrid components, connected devices, and firmware attached to a SaaS offering often are in scope. The applicability assessment exists precisely to draw that line for your specific product.
Under the CRA, the manufacturer is whoever develops or has a product with digital elements developed and markets it under their own name or brand — and they carry the bulk of the obligations. If you white-label, resell, or substantially modify someone else’s product, your role (and your obligations) can shift. We determine your exact role in the sprint.
For most products, no — the CRA allows self-assessment. Notified-body involvement is required mainly for “important” and “critical” product categories. Part of the readiness sprint is telling you which conformity-assessment route applies to your product so you don’t over- or under-invest.
No. We prepare you for compliance and, where relevant, for conformity assessment and CE marking — but we are not a certification or notified body. We’re the engineering partner that gets your product and your evidence to the point where certification is achievable. Formal certification steps are handled with our conformity-assessment partners.
Products already on the market still have to meet CRA obligations on the applicable timeline — reporting duties from 11 September 2026 and full requirements from 11 December 2027. Being “already shipping” doesn’t grandfather you out. We prioritize in-market products first in the remediation roadmap so your existing revenue stays protected.
Three stages. Engage them together, or pick the stage you need.
Cybersecurity
Tech label
AI
