CRA compliance software: a buyer's checklist
The EU Cyber Resilience Act's reporting obligations under Article 14 apply from 11 September 2026; most other obligations from 11 December 2027. If you're comparing tools, check these points.
更新時間 2026年10月11日
How Attesly keeps CRA evidence per product · Attesly plans and pricing
Before you compare tools, work through the CRA compliance checklist.
Test the workflow with one real product record. Start with one of your products and the component list you already maintain. Check whether the tool can keep its SBOM, vulnerability results, supporting documents and open evidence gaps together.
Then check which tasks stay with your team: reviewing the results, deciding which obligations apply and approving submissions. A useful comparison should show both what the software prepares and what it cannot decide for you.
| Question | Why it matters | Attesly |
|---|---|---|
| One record per product? | Classes, conformity routes and evidence differ per product | Yes – product record with suggested class and conformity route |
| SBOM import (CycloneDX / SPDX)? | Re-typing component lists doesn't scale | JSON import, upload or paste |
| Vulnerability check with rescans? | New advisories appear after release | Components with a package URL checked against OSV.dev, again on every rescan |
| Gap view for the technical file? | You need to know what's missing before an audit | Score out of 100 |
| Article 14 deadlines? | 24 h / 72 h / 14 days or one month | Calculated from your case dates, with a summary for the reporting platform |
| Role-aware? | Importers and distributors have different duties | Manufacturer, importer and distributor records for their own role |
| Export? | Your evidence must stay yours | CSV, JSON, Markdown, print to PDF |
What no CRA tool can do
No software makes a product compliant on its own or replaces your legal assessment. A good tool organises evidence, deadlines and gaps – your team decides which duties apply.