Skip to content

CRA-Akte

CRA-Akte is an evidence system for manufacturers of products with digital elements. It keeps the records the Cyber Resilience Act requires — and it keeps them where they belong: on the manufacturer's own network, with no cloud and no connection to the outside.

Status: under development (as of August 2026)

The foundation and the first modules are running and are in use at Techlogia itself. What exists today and what is still to come is listed openly below — deliberately so: a compliance tool that promises more than it delivers does more harm than none at all.

Why this matters now

The Cyber Resilience Act — Regulation (EU) 2024/2847 — applies in stages:

From What applies
11 June 2026 Chapter IV: rules on conformity assessment bodies (Art. 35–51)
11 September 2026 Article 14: reporting obligations for actively exploited vulnerabilities and severe security incidents
11 December 2027 The remainder of the Regulation — conformity assessment, technical documentation, CE marking

The reporting duty from September 2026 also covers products already placed on the market. It is the first stage that genuinely affects every manufacturer, and the deadlines are short:

  • 24 hours after becoming aware: early warning
  • 72 hours: follow-up report, as far as information is available
  • Final report: for vulnerabilities no later than 14 days after the security update, for incidents one month after the initial notification

Twenty-four hours is not an administrative process. Anyone who only starts looking during an incident — which product is affected, since when has it been on the market, who owns it — spends the deadline on the search.

What the CRA asks of a manufacturer

Four things that must remain demonstrable:

Scope. Does the product fall under the Regulation at all? The yardstick is Art. 2 and 3 — placed on the market or merely operated, with or without a data connection, and whether a remote data processing solution belongs to it. The answer is not a gut feeling but a reasoned assessment.

Product file. Per product: classification, support period, versions with the date of placing on the market, risk assessment, bill of materials for third-party components (SBOM), status of the Annex I requirements. Technical documentation under Annex VII must be kept for ten years.

Vulnerability handling. Triage incoming reports, decide, give reasons — and be able to evidence that decision later.

Reporting. To the competent CSIRT and to ENISA; in Germany via CERT-Bund at the BSI. From September 2026 this runs through ENISA's single reporting platform.

What CRA-Akte does today

Split honestly into finished and planned.

Finished and in use

Building block What it does
Legal context The relevant articles and deadlines as a searchable body of text, bilingual. If the law changes, the body of text is replaced — not the code
Scope assessment Guided questionnaire under Art. 2 and 3. Result: in scope, out of scope or unclear — stating which criterion decided it
Products and versions Product lines with classification, support period and version history including the date of placing on the market
Manufacturer details The particulars that appear verbatim in the declaration of conformity under Annex V
Accounts and roles Five roles, granting and revocation recorded. The basis for four-eyes separation
Immutability Released records are sealed and can no longer be altered at database level. Every change before that is in the audit log

That last point is the heart of it. Evidence that can be adjusted afterwards is worth little in an audit — which is why the lock does not sit in the application, but one layer below it.

| Risk assessment | Foreseeable misuse and risks with likelihood, impact, measure, reference to Annex I and stated residual risk | | Bills of materials (SBOM) | Import in CycloneDX format, checked against stored quality rules — missing licences, hashes or document metadata are named rather than silently accepted | | Vulnerabilities and triage | Assess and decide on reports, with a VEX statement per affected component | | Article 14 notifications | Cases with the three stages and their deadlines — early warning, supplementary notification, final report | | Corrective actions | What follows from a finding, who owns it and when it was completed | | Evidence package | Status of the Annex I requirements per version, released and retrievable as a package — basis for the declaration of conformity under Annex V | | Archive | Superseded versions remain retrievable instead of being overwritten (Annex VII: ten years) | | Overview and due dates | What is open, across all product lines — separated into overdue and coming up, each entry with an explanation and a jump target. 19 categories from every module, including the running Article 14 deadlines |

Planned

Submission to the single reporting platform under Article 16. The implementing acts are still pending and the field structure of the ENISA platform is not public. The system produces the report text and tracks the deadlines; submission is done by hand today. Once the structure is available it will be added as configuration — not as a rebuild.

Recurring retrieval of vulnerability feeds. Enabled sources are imported as snapshots at present, not fetched automatically. That is deliberate on an instance without internet access and a gap on one with it.

As of 11 August 2026 — what has changed since the first draft

Until 10 August 2026 the list above covered only legal context, scope assessment, products, master data, roles and sealing; everything else was listed as planned. Risk assessment, bills of materials, triage/VEX, notification cases, corrective actions, evidence package and archive are now built and in use. If you face the same deadline: talk to us and we will tell you frankly what holds today and what does not.

As of 12 August 2026 the following also applies: the combined overview across all product lines (M-10) is built and in use — until then it was wrongly listed here as planned.

What it needs

Requirement Note
A machine on your own network A small server or a VM is enough
Docker with Compose Nothing else — no Python, no Node, no database on the host
A name on the network cra.company.internal in DNS, or a .local name. TLS sets itself up
No internet access Explicitly not required

Installation is a single command. After that, a setup dialogue asks for the manufacturer details and the first administrative account.

Support period

Until 31 December 2031.

Security updates are owed throughout this period under Article 13 — regardless of subscription and licence status. The period begins on 10 August 2026.

Why this is stated here

Article 13(19) requires the end date of the support period to be stated at the time of purchase in an easily accessible manner, giving at least the month and the year. Annex II(7) requires the same information in the documentation supplied with the product. We state the exact date — that is permitted and more honest.

What it deliberately does not do

  • Phone home. No telemetry, no usage figures, no error reports. Outbound connections exist only to sources the operator enables — a vulnerability feed, for instance.
  • Update itself. A new release is installed by the operator when they have time. A compliance system that changes unnoticed is a contradiction in terms.
  • Move to the cloud. A manufacturer's records belong to the manufacturer. There is no hosted edition.

What it is not

Not legal advice. CRA-Akte classifies what follows from the data entered and the stored criteria, and makes the reasoning traceable. The legal assessment and the responsibility for accuracy, completeness and meeting deadlines remain with the manufacturer.

Not a substitute for a process. The tool records who decided what, and when. Who reports in an emergency — and who stands in when that person is on holiday — remains an organisational decision.

Sources

Interested?

CRA-Akte is built at Techlogia and used there as well — our own product file lives in our own system. If you are facing the same deadline: write to us. We will tell you what holds today and what does not yet.