Compeas GRC now supports the Cyber Resilience Act (CRA). Manufacturers of hardware and software products with digital elements can keep their products, vulnerabilities, reports and proof in the same platform as their information security management system. The CRA’s reporting duties have applied since 11 September 2026, also to products already on the market, and the rest of the regulation applies from 11 December 2027.
A duty that follows each product
NIS2 and ISO 27001 ask how an organisation protects itself. The CRA asks something else: whether each product a company places on the EU market is secure, supported and documented. The product becomes the unit of compliance, and the work starts with knowing what has been placed on the market.
The new product register records each product with digital elements: whether the CRA covers it and, if not, why; its class and the conformity assessment routes that class allows; the Member States where it is made available; and its support period. Versions and variants are kept with the product, including whether a new version is a substantial modification. Gaps, such as an undecided class or a missing end of support, show on the product until they are resolved.
Twenty-four hours from awareness
Since 11 September 2026 a manufacturer must report each actively exploited vulnerability and each severe incident affecting the security of its products: an early warning within 24 hours, a notification within 72 hours and a final report after that. Reports go through ENISA’s single reporting platform to the CSIRT designated as coordinator.
The new vulnerability register follows each vulnerability from receipt to advisory. Severity is worked out with a CVSS calculator that asks plain-language questions, or from a vector pasted from an advisory, and each company sets its own target times to fix. Once a vulnerability is judged actively exploited, the CRA’s reporting deadlines run on the record, and the people responsible are alerted before each report falls due.
Severe incidents are handled in the existing incident register. An incident that affects a covered product is assessed for the CRA, and its CRA reports appear beside the NIS2 and GDPR reports for the same incident.
Under a 24-hour deadline, nobody should be writing from scratch. Each report has a draft that follows the fields of ENISA’s single reporting platform, filled in from the record and its products and ready to copy into the platform.
Proof for each product, ahead of December 2027
From 11 December 2027 every unit placed on the market must meet the essential requirements in Annex I and carry its EU declaration of conformity and CE marking. Compeas GRC now carries the CRA’s requirements, written from the regulation and the Commission’s guidance, and says what proves each one. Seventeen of them are proven product by product, among them the risk assessment, the technical documentation and a software bill of materials for each version.
The conformity record keeps the standards applied, the notified body, the EU declaration of conformity and the CE marking with each product. Three policy templates cover vulnerability handling and coordinated disclosure, reporting, and support periods.
Where ISO 27001 work is the same process, such as vulnerability management or security testing during development, it counts towards the CRA. Where it is not, the CRA asks for proof of its own, and the progress figure shows only what has been proven.
For groups and auditors
In the Auditor Tool, groups and their auditors see each company’s product register, with the class, support period and proof of each product. Vulnerabilities are shared only when the company chooses.
“The CRA is often filed under 2027. That is a mistake: every manufacturer already has a 24-hour reporting clock on every product it has sold. With Compeas, the products, the vulnerabilities and the reports sit next to the management system the company already runs, so one team can handle both.”
Martin Karlsson, Founder & CEO, Compeas
Availability
The Cyber Resilience Act is available now to all Compeas customers, as one of the frameworks they choose alongside ISO 27001, SOC 2 or NIST CSF 2.0. To start, switch on the CRA under Frameworks. The Products section then appears in the menu, and the CRA page lists the first steps: add the products, decide each product’s class, set where reports go, adopt the disclosure policy and save the first reporting record.
This release is built for manufacturers. The duties of importers and distributors are not covered yet.
Release notes
Every change in this release, in Compeas GRC and the Auditor Tool.
Cyber Resilience Act
| Type | Change |
|---|---|
| New | The Cyber Resilience Act as a framework. 34 requirements in six domains, written from the regulation, the Commission’s guidance and its FAQ, each with what proves it and when it applies. |
| New | Getting started with the CRA. The CRA page lists the first steps and ticks each one off when it is done. |
| New | Policy templates for manufacturers. Vulnerability handling and coordinated disclosure, incident and vulnerability reporting, and product support periods. Available in English. |
Products
| Type | Change |
|---|---|
| New | Product register. Coverage, class, conformity routes, Member States and support period for each product, with its gaps and a list of what to settle before launch. |
| New | Versions and variants. Each version with its release date and whether it is a substantial modification; each variant with its security-relevant differences. |
| New | Conformity record. Standards applied, notified body, certificates, EU declaration of conformity and CE marking. |
| New | Proof for each product. The requirements the CRA sets per product are proven product by product, and the software bill of materials version by version. |
Vulnerabilities and reporting
| Type | Change |
|---|---|
| New | Vulnerability register. Each vulnerability from receipt to advisory, with the products and versions it affects, CVE and EUVD identifiers and a handler. |
| New | Severity calculator. A CVSS 4.0 score from plain-language questions, or from a pasted CVSS 4.0 or 3.x vector, with the reasons in words. |
| New | Target times to fix. Each company sets its own target for each severity. Overdue fixes are counted and reminded. |
| New | CRA reporting deadlines. Early warning, notification and final report for actively exploited vulnerabilities and severe incidents, with alerts before each one falls due. |
| New | Report drafts. Every CRA report, notice to users and security advisory drafted in the fields of ENISA’s single reporting platform, ready to copy. |
| New | Reporting settings. The main establishment, the coordinating CSIRT, the people registered on the platform and the published contacts, in one place. |
| New | CRA reporting record. A dated record of every case and report in a period, saved as evidence. |
| Improved | Severe incidents in the incident register. Incidents record the products they affect and are assessed for the CRA, beside their NIS2 and GDPR reports. |
Auditor Tool
| Type | Change |
|---|---|
| New | Products across companies. One Products page across every company, and each company’s product register with class, support period and proof. |
| New | Vulnerabilities by choice. A company can share its vulnerability register with its auditor. It is not shared unless the company chooses. |
Everyday use
| Type | Change |
|---|---|
| New | Getting started on every framework. Each framework page opens with the steps to take first, and requirements can be filtered by status and timing. |
| Improved | Evidence where the work is done. Upload evidence on a requirement, link one file to several requirements, and see on the evidence page what it counts for. Renewed evidence keeps its links. |
| Improved | Policy templates filled in on adoption. Company name, owner, classification and the revision row are filled in from the organisation’s details. |
| New | Security posture on the overview. Automated test results by area, in place of the IT assets tab. |
| Improved | Clearer wording throughout. Every page, message and email has been rewritten to be short and consistent. |
New to Compeas? Book a demo and see the product and vulnerability registers with your own products.