123% more reported CVEs per day in 2026 than last year.

CRA Compliance for Product Managers

Know what is in every release, and bring the evidence your CRA process needs to European markets

Compliance-First Product Strategy

Every build on CRACI produces an SBOM of what it actually fetched, with a completeness state, so the evidence your CRA process needs builds up as you ship, not in a scramble before launch. CRACI automates a significant part of the supply chain visibility and evidence your CRA process needs; the product decisions stay yours.

An SBOM recorded during the build Packages from npm, PyPI, Cargo, Go, OCI registries and the CI cache pass through a package-aware proxy on the CRACI runner. The job's SBOM lists what was fetched, states its completeness and exports as CycloneDX or SPDX. Package sources npm PyPI Cargo · Go OCI registries CI cache restore Package- aware proxy on the runner Job SBOM express 5.2.1 requests 2.32.3 serde 1.0.219 + transitive deps Declared license on every component Complete Completeness states per job and cache: Complete, Complete with connections, Incomplete, Unavailable, Not recorded CycloneDX · SPDX

Time-to-Market Optimization

Setup is a one-line change: install the GitHub App and set runs-on: craci. Runs still appear in GitHub, so developers keep their workflow while each build records its SBOM, runs under an egress policy and records provenance data. There is no extra step to run before a release.

Connect CRACI with a GitHub App The CRACI GitHub App is installed on all or selected repositories of a GitHub organization. CRACI can then run the jobs of the repositories you chose. Install the CRACI GitHub App Repository access for your organization All repositories Only selected repositories api-service web-app firmware sandbox CRACI runs the jobs of the repositories you chose You keep control of which repositories those are Runs, logs and checks stay in GitHub

Customer Trust & Transparency

When a customer asks what is in your product, export the SBOM in CycloneDX or SPDX, with transitive dependencies, declared licenses and the vulnerabilities found in its components. The API returns SBOMs, network traces and provenance.

SBOMs and build records for each reader SBOMs export as CycloneDX or SPDX, including transitive dependencies and the vulnerabilities found in their components, and the API returns SBOMs, network traces and provenance, so the same record serves customers, auditors and your own tooling. One record SBOMs Vulnerability records Provenance Network traces Exported from CRACI or through the API CycloneDX SBOM SPDX SBOM API: network traces API: provenance Same evidence, every audience No manual assembly between the build and the SBOM SBOMs carry transitive dependencies and vulnerabilities

Market Access & Expansion

Selling in the EU under the Cyber Resilience Act means handling vulnerabilities for the whole support period and reporting actively exploited ones. CRACI keeps re-evaluating the SBOMs of what you shipped, submits the CRA notifications on your behalf, and supplies technical evidence for your documentation. The conformity assessment and CE marking remain your process.

CRA notifications, submitted for you When a vulnerability is actively exploited, the CRA sets deadlines: an early warning within 24 hours, a notification within 72 hours and a final report 14 days after a fix is available. CRACI submits them through the CRA Single Reporting Platform to the CSIRT and ENISA on the manufacturer's behalf. Actively exploited vulnerability found Aware 24 hours Early warning 72 hours Notification Fix + 14 days Final report CRACI submits on your behalf Through the CRA Single Reporting Platform to the CSIRT and ENISA and shows which products and releases are affected What stays with you The reporting obligation itself Informing affected users Severe incidents: final report within one month

Ship compliant products faster

Book a demo to accelerate product development with CRACI

Book a demo