EU Cyber Resilience Act.Automated Compliance.
The EU Cyber Resilience Act doesn't negotiate. Miss a single 24h early warning or 72h full notification, and you face fines up to €15 million or 2.5% of global turnover—plus recalls, legal exposure, and reputational damage. Cramio automates SBOMs, tracks every CVE, and submits to ENISA on time. Built for manufacturers, importers, and distributors across the EU.
Everything you need to meet EU vulnerability reporting requirements with automated intelligence, verified evidence, and rapid 24h/72h reporting workflows.
Built for manufacturers who can't miss a deadline
GitHub, GitLab, ENISA, and CISA refer to ecosystems and authorities we align with — not third-party endorsements.
“Cramio cut our 24h/72h report preparation from days to hours. We have one place for SBOMs, CVEs, and ENISA submissions — and the Evidence Vault gives our legal team exactly what they need.”
Compliance Lead
EU industrial software manufacturer
Sept 2026 Reporting. Dec 2027 Full Enforcement.
Reporting is the operational inflection point. You have 7 months to prepare your SBOMs, incident response, and SRP readiness before the first deadlines hit.
Three steps from detection to proof of diligence.
Discover & assess
Auto-build and maintain SBOMs. Run continuous risk assessments across design, build, and runtime.
- Vendor and OSS due diligence with ownership tags.
- Legacy product coverage for pre-2027 obligations.
Monitor & correlate
Track vulnerabilities and detect when they become actively exploited — the CRA trigger for notification.
- CISA KEV + exploit intel correlation.
- Global incident stopwatch with escalation alerts.
Report & prove
Generate 24h/72h SRP notifications, then the final report, and retain an immutable evidence trail.
- One-click SRP submissions with receipts.
- Hash-chained evidence vault for audit defense.
Hybrid SaaS, self-hosted, or white-label — Enterprise and custom deployments.
Move Fast. Stay Compliant. Every Step Automated.
Standards-ready documentation
Reporting in 2026, full product requirements in 2027, and harmonized standards developed with CEN/CENELEC/ETSI — cramio keeps your dossier ready for notified-body review, with versioned SBOMs, VEX statements, and SRP receipts packaged on demand.
Simple, transparent pricing for every business.
From startups to enterprise. No hidden fees, no surprises.
Self-hosted, white-label, SLA. We'll tailor a plan.
Built for regulated manufacturers.
Here's what you get when you sign in.
Every feature on this page lives in your Cramio dashboard. Here's how they fit together — from registering your first product to proving compliance in an audit.
Register products and upload SBOMs
Add every digital product subject to the CRA — IoT devices, firmware, embedded software, or standalone applications. Upload CycloneDX or SPDX SBOMs, or connect your CI pipeline so Cramio automatically ingests SBOMs from your build process. Each product gets a full component inventory with supplier, license, and dependency tracking.
Continuous CVE monitoring with exploit detection
Scan every component against the NVD and CISA Known Exploited Vulnerabilities catalog. Cramio correlates exploit intelligence in real time, so you know instantly when a vulnerability goes from theoretical to actively exploited — the CRA trigger for mandatory reporting. Filter by severity, product, or status and drill into CVSS scores, affected versions, and remediation guidance.
Live countdown timers for every reporting window
When a vulnerability is confirmed as actively exploited, Cramio creates an incident and starts the legal clock. You see live countdown bars for the 24-hour early warning, 72-hour full notification, and 14-day final report — with escalation alerts at 50%, 75%, and 90% so nothing slips. Every action taken during an incident is automatically logged to the Evidence Vault.
One-click CRA reports with AI-assisted drafting
Create CRA Article 14(2) reports directly from the dashboard. Select the affected product and vulnerability, choose the report type (24h early warning, 72h full notification, or 14d final report), and optionally let AI draft the initial content from your SBOM and scan data. Reports follow the exact schema required by the Single Reporting Platform, and every submission receipt is captured and stored.
Declare exploitability status to prevent over-reporting
Not every CVE affects your product. Create VEX (Vulnerability Exploitability eXchange) statements to formally document that a vulnerability is not affected, already fixed, or under investigation. VEX statements appear on both the product and vulnerability views, reducing noise and focusing your team on real threats.
Tamper-proof audit trail
Every incident action, report submission, and VEX statement is automatically recorded in a SHA-256 hash-chained vault. Chain integrity is checked when entries are loaded; a break indicates tampering. Your dashboard shows total entries, integrity status, and recent activity at a glance.
Know your compliance score
A real-time assessment calculates your readiness across 10 compliance checks — SBOM coverage, vulnerability resolution, incident response, ENISA reporting, VEX usage, evidence vault health, and team setup. You get a letter grade (A-F), a percentage score, and specific recommendations with direct links to fix each gap.
Everything in one view — compliance score, active incidents, and live alerts
Your main dashboard brings it all together: a CRA compliance score ring weighted across SBOM coverage, vulnerability resolution, incident response, and report submissions. Active incidents with live countdown bars sit alongside the evidence vault status, critical vulnerability alerts, and quick links to your most recent products and reports. Real-time notifications keep your team informed as deadlines approach and new vulnerabilities are detected.
Core workflows — products, SBOMs, scans, incidents, reports, vault, and assessment — are available in the dashboard. Enterprise deployment modes are scoped with sales.
Frequently asked questions
CRA deadlines, data, and getting started.
Start free — be CRA-ready before the deadline.
Sign up to run a free CRA readiness assessment, then activate your trial to automate 24h/72h compliance workflows.