Regulation (EU) 2024/2847
Comply with the Cyber Resilience Act, by role and product class
The EU regulation on cybersecurity for products with digital elements (PDEs). Obligations switch on from your role — manufacturer, importer, distributor or open-source steward — and each product’s class (default / Important / Critical), tracked against the phased deadlines (reporting duties from 11 September 2026; full application 11 December 2027). A per-product register, a conformity tracker, SBOM tracking and the 24-hour / 72-hour vulnerability-reporting workflow — not a generic checklist.
43
obligations mapped
24h / 72h
incident reporting
11 Dec 2027
full application
- Scoped by role and product class
- Per-product register + classification
- Conformity + SBOM tracker
- 24h / 72h vulnerability reporting
What’s in the module
The regulation, scoped to your products
Not a fixed checklist — a role- and product-class-scoped obligation set with a per-product layer, tracked against the phased deadlines.
- 01
Scoped by role and product class
Obligations switch on from your role(s) and each product’s class — default, Important (Class I / II) or Critical — so you only ever work the list that applies to you.
- 02
Per-product register + classification
Inventory every product with digital elements and classify it with an AI-assisted wizard, tracking its conformity route and CE marking.
- 03
Conformity + SBOM tracker
Risk assessment → technical documentation → declaration → CE marking, with a software bill of materials (SBOM) maintained per product.
- 04
24h / 72h vulnerability reporting
The Article 14 early-warning, notification and final-report workflow for actively-exploited vulnerabilities and incidents, tracked end to end.
How it runs
From your product portfolio to the 2027 deadline
Computed applicability
Set your role(s) and product classes once; Obligara switches each obligation in or out of scope and writes the justification — so you work the list that actually applies to you.
Per-product classification & reporting
Classify each product with digital elements, track its conformity route and CE marking, maintain an SBOM, and run the Article 14 24-hour / 72-hour vulnerability and incident reports.
A compliance aid, not legal advice
A structured way to manage the CRA obligations, grounded in the Regulation and reusing your evidence store — with a human deciding what applies. It supports your legal team; it doesn’t replace it.
Pairs naturally with ISO 27001 and the EU AI Act: run product cybersecurity, your ISMS and your AI obligations off one evidence store with a real cross-walk between them.
See the Cyber Resilience Act on your product portfolio
Tell us your role and products and we’ll show which obligations apply, your classification and the reporting workflow — live.