CRA compliance software that starts in your build
CRACI automates a significant part of the supply chain visibility and evidence your Cyber Resilience Act process needs: SBOMs recorded from every build, vulnerability monitoring after you ship, CRA notifications submitted on your behalf and provenance data. The risk assessment, conformity assessment and declaration of conformity stay with you, the manufacturer.
The CRA timeline is ticking
Key milestones you need to prepare for under the Cyber Resilience Act.
SBOMs recorded from the build
The CRA asks for a software bill of materials in a machine-readable format. CRACI records one while your GitHub Actions release build runs: every package the job pulled in, including packages restored from CI caches, exported as CycloneDX or SPDX with transitive dependencies and each component's declared license. Each job's SBOM carries a completeness state, so you know whether the record is whole.
Vulnerability handling after you ship
Manufacturers handle vulnerabilities for the whole support period. CRACI keeps re-evaluating the SBOMs of what you shipped against new vulnerabilities, aggregates findings across builds and repositories, and lets security teams triage them and send them to the teams that own the fix. It supports VEX, monitors vendor SBOMs alongside your own builds, and its inventory view shows which software versions are deployed to which products.
CRA notifications, submitted for you
Since September 11, 2026, an actively exploited vulnerability starts a clock: an early warning within 24 hours, a notification within 72 hours and a final report within 14 days of a fix. CRACI submits these notifications to the authorities on your behalf. The reporting obligation stays yours; CRACI handles the submission and shows which products and releases are affected.
Evidence for conformity assessment
CRACI does not carry out conformity assessments. It collects the technical evidence one needs: build-time SBOMs, vulnerability and remediation records, provenance and network traces. SBOMs export as CycloneDX or SPDX and the rest comes through the API. The assessment route, the declaration of conformity and any notified body remain the manufacturer's process.
Which CRA obligations CRACI provides evidence for
The CRA's reporting obligations have applied since September 11, 2026, including for products already on the market, and the rest of the regulation applies from December 11, 2027. Here is what CRACI does for each obligation that touches the software supply chain, and what remains the manufacturer's process.
| Obligation | Where in the CRA | What CRACI provides | What stays with you |
|---|---|---|---|
| Software bill of materials | Annex I, Part II (1); Annex VII | An SBOM from every build job, in CycloneDX or SPDX, with transitive dependencies, declared licenses and a completeness state. | Keeping it in the technical documentation and providing it to a market surveillance authority on request. |
| Vulnerability handling for the support period | Article 13(8); Annex I, Part II | Continuous monitoring of shipped SBOMs, triage and routing to owning teams, VEX, and vendor SBOMs monitored alongside your builds. | Setting the support period, fixing and shipping security updates, and running a coordinated vulnerability disclosure policy. |
| Reporting exploited vulnerabilities and severe incidents | Article 14 | Submits the early warning, notification and final report on your behalf, and shows which products and releases are affected. | The obligation itself, and informing affected users. |
| Due diligence on third-party components | Article 13(5) | A record of every package each build fetched, an egress policy on the build network, and monitoring of vendor SBOMs. | Choosing components and suppliers, and acting on what the record shows. |
| Technical documentation and traceability | Article 31; Article 13(13); Annex VII | SBOMs, network traces and provenance data through the API, and SBOM export as CycloneDX or SPDX. Data is kept 180 days by default, with custom retention on Enterprise. | The technical file itself, kept for at least 10 years or the support period, whichever is longer. |
| Risk assessment and product security requirements | Article 13(2); Annex I, Part I | Not covered. | The cybersecurity risk assessment and secure design, such as secure defaults, access control and data protection. |
| Conformity assessment, declaration of conformity, CE marking | Articles 28, 30 and 32 | Evidence only. CRACI does not assess, certify or manage the assessment. | Running the assessment, with a notified body where the product class requires one, and signing the declaration. |
CRACI runs your GitHub Actions jobs on its own runners, which is why it can record the build instead of scanning it afterwards. Other CI systems are on the roadmap.
Made for global companies operating in Europe.
CE marking will soon cover software products under the Cyber Resilience Act, requiring every software manufacturer to pass conformity assessment before selling in the EU. CRACI helps you get ready without slowing down your development.
Compliance that ships with your code
Record an SBOM from every build, monitor it for new vulnerabilities, and export it as CycloneDX or SPDX, directly from your CI/CD pipeline. No separate tools needed.
From detection to disclosure in 24 hours
When vulnerabilities are detected, CRACI helps you triage, document, and report them to ENISA within the required timeframe. Automated workflows ensure nothing falls through the cracks.
One place for everything CRA
Stop juggling spreadsheets, emails, and disparate tools. CRACI provides a unified dashboard for all your CRA compliance needs—vulnerability tracking, SBOMs, and CRA notifications.
Compliance that ships with your code
Record an SBOM from every build, monitor it for new vulnerabilities, and export it as CycloneDX or SPDX, directly from your CI/CD pipeline. No separate tools needed.
From detection to disclosure in 24 hours
When vulnerabilities are detected, CRACI helps you triage, document, and report them to ENISA within the required timeframe. Automated workflows ensure nothing falls through the cracks.
One place for everything CRA
Stop juggling spreadsheets, emails, and disparate tools. CRACI provides a unified dashboard for all your CRA compliance needs—vulnerability tracking, SBOMs, and CRA notifications.
CRA compliance, answered
What the Cyber Resilience Act asks of manufacturers, and where CRACI fits
What is CRA compliance?
CRA compliance means a product with digital elements meets the EU Cyber Resilience Act, Regulation (EU) 2024/2847, when it is placed on the EU market and throughout its support period. For manufacturers that covers a cybersecurity risk assessment, the essential requirements in Annex I, vulnerability handling including an SBOM, reporting of actively exploited vulnerabilities and severe incidents, technical documentation, a conformity assessment, an EU declaration of conformity and the CE marking.
Does CRACI make my product CRA compliant?
No tool does. Compliance is a process the manufacturer runs. CRACI automates a significant part of the supply chain visibility and evidence your CRA process needs: build-time SBOMs, vulnerability monitoring, CRA notifications submitted on your behalf, provenance data and exportable evidence.
What does CRA compliance software need to do?
On the technical side: produce a trustworthy SBOM for each release, monitor it for new vulnerabilities for the whole support period, find affected products fast enough for the 24-hour early warning, and keep evidence you can hand to an authority. On the governance side: map requirements to controls and track the risk assessment and the conformity assessment. CRACI covers the technical side for software you build with GitHub Actions.
Does the CRA require an SBOM?
Yes. Annex I, Part II, point 1 requires manufacturers to draw up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the product. It belongs in the technical documentation, which a market surveillance authority can request. The CRA does not require you to publish it.
When do the CRA reporting obligations apply?
From September 11, 2026, and they also cover products placed on the market before December 11, 2027. The rest of the regulation applies from December 11, 2027.
Does CRACI carry out the conformity assessment?
No. CRACI does not carry out conformity assessments, manage the assessment process, issue certificates or act as a notified body. It supplies the technical evidence the assessment asks for.
Which CI systems does CRACI work with?
GitHub Actions today. You switch a workflow to CRACI with runs-on: craci, and runs still appear in GitHub. Other CI systems, starting with GitLab CI and Jenkins, are on the roadmap.
See the CRA evidence from one of your builds
Book a demo and we will walk through the SBOM, monitoring and reporting CRACI produces from a GitHub Actions release build
Book a demo