The EU's Cyber Resilience Act is already live — and your product is already on the market.

Since 11 September 2026 you owe the EU a 24-hour report when a vulnerability in your product is actively exploited. From 11 December 2027, every software and connected product you sell into the EU needs Annex I security requirements met, an SBOM, a technical file, and a CE mark. CRAReady classifies your product, scores your readiness, builds your reporting playbook and document pack, and dates every step to the deadline. Fixed price. Documents and readiness only — not legal advice, not a notified body.

The done-for-you Cyber Resilience Act readiness pack for non-EU and small software & connected-product makers selling into the EU — product classification, Annex I readiness score, the already-live Article 14 reporting playbook, SBOM + technical-file index, and a dated workback to 11 December 2027. Readiness and documents only: never legal advice, never a conformity assessment, never an authorised representative, never filing on your behalf.

Pricing — fixed price, paid via Stripe

Try the checker

After purchase, send your case data as JSON matching checker/example-case.json. The readiness checker runs at POST /api/check and returns a scored markdown report. Health: GET /api/health.

Example report (from the shipped example case)

# CRAReady — Readiness Report: LedgerLink Sync (desktop software)

**Classification (indicative):** DEFAULT
**Conformity route:** Manufacturer self-assessment (internal production control, Module A)
**Note:** Default category — self-assessment available, with full Annex I evidence still required.
**Readiness score:** 100/100 — **READY**

## Gaps
- None — all scored areas fully evidenced.

## Workback calendar (to main application 2027-12-11)
- **Now:** Stand up the Article 14 24h/72h reporting workflow (already applicable since 2026-09-11)
- **2027-03-01:** Freeze product classification + conformity route; engage notified body if Class II / Critical
- **2027-06-30:** Complete Annex I Part I evidence + risk assessment draft
- **2027-09-30:** SBOM generation in pipeline; vulnerability-handling + CVD policy published
- **2027-11-15:** Annex VII technical file assembled; EU declaration of conformity drafted; support period declared
- **2027-12-11:** Main CRA obligations apply — CE marking + declaration in place before placing on the market

_Readiness and documents only — not legal advice, not a conformity assessment, not an authorised representative. Facts cited to Regulation (EU) 2024/2847._