01
Connect your repository
GitHub or GitLab. CRAcheck reads your manifests (package.json, requirements.txt, go.mod…) — nothing to install.
octocat/payments-api Connected
Reading manifests…
package.jsongo.modrequirements.txt
Prepare your compliance with the
Cyber Resilience Act.
SBOM, technical documentation and EU declaration — generated and maintained automatically from your repo. CRAcheck prepares and documents your compliance; you review and sign. Without reading 200 pages of regulation.
No credit card · −50% for life for early sign-ups
cracheck.eu/app — compliance generator
But what is the CRA?
The EU regulation that sets cybersecurity rules for almost every digital product. We explain the essentials in 2 minutes.
Understand the CRA →€15M
maximum fine for non-compliance
Sep '26
1st deadline: reporting obligations
~90%
of products fall under self-assessment
5
questions to know your status
/ The generator
Your CRA compliance, generated. Not endured.
The regulation is 200 pages long. You ship code. CRAcheck turns your repository into a complete compliance file — in minutes.
Join early access →02
SBOM generated automatically
Your full software bill of materials in CycloneDX or SPDX format, kept up to date on every build.
CycloneDXSPDX142 components
react18.3.1
golang.org/x/cryptov0.21
requests2.31.0
alpine3.19
03
Technical documentation + EU declaration
The technical file (CRA Annex) and your EU declaration of conformity, pre-filled and ready to sign.
Technical documentation
Annex VII
EU declaration of conformity
(EU) 2024/2847
CE marking
ready to affix
04
Vulnerability policy & reporting
Your vulnerability handling policy, plus the ENISA reporting templates (24h / 72h / 14 days).
CVE-2024-3094 detectedopenssl
Report to ENISAon time
24halert
72hnotify
14dreport
/ Step 0 · free
Not sure you're affected?
First, check in 1 minute whether the CRA applies to your product. Free, no sign-up.
What do you distribute?
Pick what best describes your main product.
Free · no sign-up · no data sent (the test runs in your browser)
/ Why CRAcheck
Compliance, without the jargon or the fear.
Based on the official text
Scope, risk categories and obligations taken from Regulation (EU) 2024/2847 — no guesswork, no AI making things up. Every verdict is grounded in the regulation.
Read the regulationCanva visual — Based on the official text
Built for small vendors
Solo devs, app makers, IoT, commercial open source. Enterprise tools ignore you or charge €500/month. CRAcheck is built for you, at your scale.
See pricingCanva visual — Built for small vendors
Honest, not marketing
We prepare and document. We don't pretend to “certify you compliant”: you stay in control, with no false promise or legal jargon.
How it worksCanva visual — Honest, not marketing
/ All-in-one
It doesn't just scan. It watches for you.
Once your repo is connected, CRAcheck works continuously — even when you don't log in.
Notifications that matter
You don't have to think about it: we email you the moment something important happens for your compliance. Zero noise, just the essentials.
Weekly digest
Every Monday: your score, what changed, your upcoming deadlines.
Security alert
New critical flaw on a dependency → immediate email.
Deadline reminder
30 then 7 days before each key date of your CRA plan.
Organized CRA plan
A board listing everything you must do, in order, with the real deadlines. No more guessing where to start.
Verifiable attestation
A signed certificate + a public page your customers check themselves. Your compliance becomes a selling point.
Pre-filled documents
EU declaration, technical documentation, SECURITY.md — generated from your repo and profile. You review, you sign.
ENISA reporting ready
The day a flaw is exploited, the assistant pre-fills your 24h / 72h / 14d reports. No panic.
Check on every PR
The CRA score shows on your pull requests like a test that passes or fails. Compliance enters your workflow.
Evidence vault
Every scan and document is timestamped in a journal. It's what a regulator or B2B customer will ask for.
/ Comparison
Three ways to prepare your CRA compliance. Only one is built for you.
Do it yourself
€0 — but days of work
- Setup — Days
- SBOM generated automatically
- Technical docs + EU declaration
- Vulnerability reporting (ENISA)
- Regulatory updates tracked
- Built for small vendors
- Support in French
Enterprise tools
€500+ / month
- Setup — Long onboarding
- SBOM generated automatically
- Technical docs + EU declaration
- Vulnerability reporting (ENISA)
- Regulatory updates tracked
- Built for small vendors
- Support in French
Recommended
CRAcheck
€25 / month
- Setup — A few minutes
- SBOM generated automatically
- Technical docs + EU declaration
- Vulnerability reporting (ENISA)
- Regulatory updates tracked
- Built for small vendors
- Support in French
* Doing it yourself is free in money, but costs days of work and a real risk of error.
Open source vulnerability database/ Vulnerability detectionEvery dependency, checked against the OSV.dev database.
OSV.dev is the reference open source vulnerability database, fed by Google, GitHub Security Advisories, PyPA, RustSec… On every push, your SBOM is cross-checked against it: a new CVE on one of your dependencies means a recalculated score + an email alert. No black-box scanner — a public, auditable source, cited in your technical documentation.
9 ecosystems (npm, PyPI, Go, Rust, Maven…) CVE · GHSA · PYSEC · RUSTSEC Re-scan on every push
cracheck — compliance scan
$ scan Traxxouu/shop — 1,513 components → OSV.dev
✓ next@16.2.70 advisory
✓ stripe@22.2.20 advisory
✗ xz-utils@5.6.0CVE-2024-3094 · critical
✗ lodash@4.17.20CVE-2021-23337 · high
✓ fastapi@0.115.20 advisory
✓ tokio@1.44.10 advisory
→ score recalculated: 70/100 · email alert sent · timestamped evidence
/ Pricing
Lock in −50% for life before it rises to €50/month.
On September 11, 2026, vulnerability reporting becomes mandatory. The €25/month launch price runs until the end of 2026, then moves to €50. Early adopters keep €25/month — for life.
139 days before the price moves to €50/month
Free
To get your score and start.
€0/ no card
Start for free- Unlimited eligibility test (no sign-up)
- CRA score + compliance dashboard (1 repo)
- Downloadable CycloneDX SBOM
- Alerts for the CRA's key dates
−50% for life · early accessGo Pro now
CRAcheck Pro
Your compliance generated, monitored and attested continuously — ready to show your customers.
€25
€50/ month
for life, as long as you stay subscribed
Secure payment via Stripe · no commitment · cancel in one click
- Everything in the free plan
- Pre-filled technical documentation + EU declaration
- ENISA reporting ready to send (24h / 72h)
- Unlimited repos, re-scanned on every push
- Vulnerability alerts + evidence vault
- Verifiable attestation: signed certificate + QR + public page
Your compliance becomes a sales argument
Your customers and prospects verify your attestation themselves on cracheck.eu/verify — signed certificate, README badge, real-time status.
A CRA consultant charges €3,000–5,000 for a report that's outdated the day it's delivered. CRAcheck keeps your compliance alive all year — for the price of one lunch a month.
/ FAQ
The questions people actually ask.
Is SaaS affected by the CRA?+
Generally no: cloud-only SaaS falls under the NIS2 directive, not the CRA. The exception: if it ships a component installed on the customer side (agent, plugin, firmware) that's required to operate. The test settles your specific case.
What about open source?+
Open source developed outside of a commercial activity is exempt. As soon as a company commercializes it or integrates it into a product it sells, that company carries the CRA responsibility.
Is this legal advice?+
No. CRAcheck provides information based on the official text to guide and prepare you. For formal validation, consult a professional.
When do I need to be ready?+
Vulnerability reporting obligations apply from September 11, 2026. The main obligations (CE marking, EU declaration of conformity) from December 11, 2027.
What's the penalty for non-compliance?+
Up to €15M or 2.5% of worldwide annual turnover for a breach of the essential cybersecurity requirements.
Is the test really free?+
Yes: unlimited, no sign-up, and it runs in your browser. Only the document generator is paid (€25/month).
Blog
Stay ahead of the CRA
CRA compliance
EU Cyber Resilience Act: Strategic Priorities for Startups Before 2027
A strategic roadmap for startup founders and CTOs to navigate EU Cyber Resilience Act compliance requirements ahead of the 2026 and 2027 enforcement deadlines.
Practical guides
Building Your First SBOM: A Practical Guide for Developers
Overwhelmed by SBOM requirements? Learn how to generate, manage, and maintain a Software Bill of Materials to ensure supply chain security and compliance.
Practical guides
Solo Developer's Guide: Achieving EU CRA Compliance Without Consultants
Master the EU Cyber Resilience Act as a solo developer. Follow this practical, step-by-step roadmap to achieve compliance without hiring expensive consultants.
Regulation
CRA: The True Financial and Operational Cost of Non-Compliance
Understand the severe financial penalties, operational risks, and market exclusion consequences of failing to comply with the EU Cyber Resilience Act.
CRA compliance
5 Critical Mistakes to Avoid in Your CRA Compliance Journey
Avoid common pitfalls with the EU Cyber Resilience Act. Learn how to manage SBOMs, meet ENISA reporting deadlines, and automate your compliance workflow.
CRA compliance
Cyber Resilience Act: Essential Compliance Roadmap for 2026
A strategic action plan for software vendors to meet the mandatory EU Cyber Resilience Act incident reporting requirements by September 2026.
/ Take action
Generate your compliance, don't endure it.
On September 11, 2026, reporting becomes mandatory. The €25/month launch price runs until the end of 2026, then €50. Go Pro now and keep €25/month for life.
Stripe payment · no commitment · cancel in one click
