Your products ship to Europe. The CRA now decides your market access.

CRA implementation includes: (1) Secure-by-design development lifecycle—integrating SAST/DAST tools, security requirements in design phases, threat modeling, (2) Vulnerability management program—SBOM generation automation, dependency tracking, vulnerability disclosure procedures, 24-hour ENISA notification workflows, (3) Security update deployment—lifetime update processes, patch management, customer notification systems, (4) Conformity assessment preparation—technical documentation, security testing evidence, CE marking documentation, and (5) Management system—policies, procedures, and governance framework for ongoing CRA compliance.

Not required, but highly recommended. If you already know your gaps from an internal assessment, you can start implementation directly. However, a gap analysis gives you objective answers about where you stand compared to CRA requirements, helps prioritize implementation efforts, and prevents wasted resources on the wrong areas. Many clients do a gap analysis first (2-3 weeks) to understand their compliance status, then engage us for implementation (12-18 months) with a clear, prioritized roadmap.

CRA gap analysis (2-3 weeks) assesses where you stand—it gives you a compliance scorecard, prioritized gap list, and remediation roadmap. CRA implementation (12-18 months) is the actual work—building secure-by-design processes, setting up vulnerability management, implementing security updates, preparing for conformity assessment, and achieving CE marking. Think of gap analysis as the assessment, implementation as the execution. You can do gap analysis first to understand what needs to be done, then implementation to actually do it.

CRA compliance is ongoing—it requires continuous vulnerability management, security updates throughout product lifetime, and regular conformity assessments. We implement a management system with policies, procedures, and governance that ensures ongoing compliance. This includes: automated SBOM generation, continuous dependency monitoring, vulnerability disclosure workflows, security update deployment processes, and documentation maintenance. After implementation, you'll have the systems in place to maintain compliance, and we can provide ongoing support for updates and audits.

After December 2027 enforcement, non-compliant products cannot be sold in the EU market. Penalties include up to €15 million or 2.5% of global annual turnover (whichever is higher) per violation. Non-compliant products face market access restrictions, and companies may face enforcement actions from national authorities. Starting implementation now ensures you have time to build compliant systems, complete conformity assessment, and achieve CE marking before the deadline. The 12-18 month timeline gives you buffer time for testing and refinement.

Yes, CE marking is part of CRA implementation. We help you prepare all technical documentation required for conformity assessment, including: security-by-design evidence, vulnerability management documentation, security update procedures, and testing results. We guide you through the conformity assessment process and help you achieve CE marking before December 2027. CE marking demonstrates your products meet CRA requirements and allows continued EU market access.

Not necessarily. While each product needs its own SBOM and conformity assessment, you can implement a unified management system covering all products. We build secure-by-design processes, vulnerability management, and security update systems that apply across your product portfolio. Each product gets its own technical documentation and CE marking, but the underlying management system, policies, and procedures can be shared. This is more efficient and cost-effective than implementing separately for each product.