Audit & guidance
Are you actually in scope of the Cyber Resilience Act?
Most manufacturers get the answer wrong. Some believe their certification covers them and it does not. Others believe they are excluded while half their catalogue is in scope.
I settle the question product by product, article by article, and hand you the documents the regulation requires.
The diagnostic is free. The full audit starts at €590.
Please note: this service is delivered in French only. The analysis, the written report and the debrief call are all in French, and I currently work with French-speaking clients.
Start with the free diagnostic
Leave your work email. I get back to you within 24 business hours to collect read access to one repository, then send you the commented report and the SBOM. No card, no commitment.
Who runs the audit
Maël Barbe
I built CRAcheck, the tool that produces these documents. I read your repository, I write the report, and I answer the phone. You will not go through a salesperson.
Leave your email and I'll send you two or three 20-minute slots the same day. No automated calendar, no sales demo — just a conversation about whether your product is in scope, and on what grounds.
Three ways to work together
The subscription is a tool you plug in yourself. The audit and the guidance are services I carry out for you. Choose according to who writes the software at your company.
CRAcheck subscription
25 € / month
Launch price, for life for the first 100. €50 afterwards.
For whom
You write the software yourself and you have a technical team.
- Unlimited repositories, scanned on every push
- Always-current CycloneDX SBOM
- Continuous vulnerability monitoring
- Generated EU declaration and technical documentation
- ENISA reporting assistant
CRA audit
890 € one-off
€590 for the first five clients
50% deposit on order, balance on delivery.
For whom
You manufacture a product and you do not know whether the regulation applies to you.
- Up to 3 products, or one full product line
- Scope settled product by product, exclusions included
- Classification: default category, Annex III or Annex IV
- Annex I §1 and §2 gaps, ranked by effort and risk
- EU declaration, Annex VII documentation, SECURITY.md
- Support period to declare (Article 13(8))
- 45-minute video debrief
Guidance
On quote quarterly
When compliance has to hold release after release.
For whom
You want someone to follow the subject over time, not just once.
- The full audit as a starting point
- ENISA reporting set-up (24 h / 72 h / 14 days)
- Compliance review on every major release
- Training for your technical team
- Quarterly follow-up
- Direct access, no ticket, no middleman
The audit covers up to 3 products or one full product line; beyond that, the scope is quoted separately. 50% deposit on order, balance on delivery. The service is delivered in French. It supports your self-assessment: it is neither legal advice, nor certification by a notified body, nor a guarantee of conformity — the compliance of your products remains your responsibility. Prices exclude VAT, in euros. See the terms.
Do you recognise your situation?
Five situations I keep running into with manufacturers. Open the one that looks like yours.
You sell a connected product under your own brand
Sensor, gateway, controller, instrument, embedded unit. You are a manufacturer under Article 3(13) even when the electronics or firmware come from a partner: what matters is the name on the product.
You believe you are out of scope. Sometimes wrongly
Medical, automotive, civil aviation and defence fall outside the CRA. But the carve-out covers the product, not the company. A sports line beside a medical line, retrofit beside original equipment, and half the catalogue falls back in.
Your customers will start asking you for deliverables
You design for industrial customers who place the product on the market. The liability sits with them — the software inventory sits with you. They will ask for it, including on projects delivered years ago.
Your certification covers less than you think
ISO 9001, ISO 13485, EN 50128, EN 18031: these are quality, functional-safety or radio standards. None of them produces a software bill of materials, a coordinated disclosure policy or ENISA reporting.
Products already sold are not all exempt
The Article 69 grandfathering protects the unit sold before 11 December 2027, not the model. Every new unit sold after that date must comply. And the reporting duty already applies to the deployed base.
Manufacturers
You sell a connected product under your own brand
Sensor, gateway, controller, instrument, embedded unit. You are a manufacturer under Article 3(13) even when the electronics or firmware come from a partner: what matters is the name on the product.
So what actually happens?
Four steps, two weeks at most. No kick-off meeting to prepare, no thirty-page questionnaire to fill in.
Start with the diagnostic
I read your repository
You give me read access. I analyse dependencies, versions, licences and known vulnerabilities for every component.
What I analyse
And any other ecosystem: if you already produce a CycloneDX software bill of materials — from Yocto, a C/C++ build, an in-house tool — I take it as is. The language is never a blocker, just ask.
Ask the question, even if you buy nothing
“Is my product in scope?” is a question I answer for free, in a few lines, with nothing to sell behind it. If the answer is no, I will say so — it has happened more than once.
Just tell me where you stand
The email is enough. The other two fields are optional.