Skip to content

CRA-Akte

CRA-Akte is an evidence system for manufacturers of products with digital elements. It keeps the records the Cyber Resilience Act requires — and it keeps them where they belong: on the manufacturer's own network, with no cloud and no connection to the outside.

Status: under development (as of August 2026)

The foundation and the first modules are running and are in use at Techlogia itself. What exists today and what is still to come is listed openly below — deliberately so: a compliance tool that promises more than it delivers does more harm than none at all.

Why this matters now

The Cyber Resilience Act — Regulation (EU) 2024/2847 — applies in stages:

From What applies
11 June 2026 Chapter IV: rules on conformity assessment bodies (Art. 35–51)
11 September 2026 Article 14: reporting obligations for actively exploited vulnerabilities and severe security incidents
11 December 2027 The remainder of the Regulation — conformity assessment, technical documentation, CE marking

The reporting duty from September 2026 also covers products already placed on the market. It is the first stage that genuinely affects every manufacturer, and the deadlines are short:

  • 24 hours after becoming aware: early warning
  • 72 hours: follow-up report, as far as information is available
  • Final report: for vulnerabilities no later than 14 days after the security update, for incidents one month after the initial notification

Twenty-four hours is not an administrative process. Anyone who only starts looking during an incident — which product is affected, since when has it been on the market, who owns it — spends the deadline on the search.

What the CRA asks of a manufacturer

Four things that must remain demonstrable:

Scope. Does the product fall under the Regulation at all? The yardstick is Art. 2 and 3 — placed on the market or merely operated, with or without a data connection, and whether a remote data processing solution belongs to it. The answer is not a gut feeling but a reasoned assessment.

Product file. Per product: classification, support period, versions with the date of placing on the market, risk assessment, bill of materials for third-party components (SBOM), status of the Annex I requirements. Technical documentation under Annex VII must be kept for ten years.

Vulnerability handling. Triage incoming reports, decide, give reasons — and be able to evidence that decision later.

Reporting. To the competent CSIRT and to ENISA; in Germany via CERT-Bund at the BSI. From September 2026 this runs through ENISA's single reporting platform.

What CRA-Akte does today

Split honestly into finished and planned.

Finished and in use

Building block What it does
Legal context The relevant articles and deadlines as a searchable body of text, bilingual. If the law changes, the body of text is replaced — not the code
Scope assessment Guided questionnaire under Art. 2 and 3. Result: in scope, out of scope or unclear — stating which criterion decided it
Products and versions Product lines with classification, support period and version history including the date of placing on the market
Manufacturer details The particulars that appear verbatim in the declaration of conformity under Annex V
Accounts and roles Five roles, granting and revocation recorded. The basis for four-eyes separation
Immutability Released records are sealed and can no longer be altered at database level. Every change before that is in the audit log

That last point is the heart of it. Evidence that can be adjusted afterwards is worth little in an audit — which is why the lock does not sit in the application, but one layer below it.

Planned

Risk assessment · Bills of materials (SBOM) · Vulnerabilities and triage with VEX · Article 14 reporting cases · Corrective actions · Evidence package and declaration of conformity · Archive · Overview with due dates.

What is not possible yet

Article 14 reporting cases are not yet part of the application. If you have to cover the September 2026 deadline, you will need another route until then — talk to us and we will tell you frankly what holds and by when.

What it needs

Requirement Note
A machine on your own network A small server or a VM is enough
Docker with Compose Nothing else — no Python, no Node, no database on the host
A name on the network cra.company.internal in DNS, or a .local name. TLS sets itself up
No internet access Explicitly not required

Installation is a single command. After that, a setup dialogue asks for the manufacturer details and the first administrative account.

What it deliberately does not do

  • Phone home. No telemetry, no usage figures, no error reports. Outbound connections exist only to sources the operator enables — a vulnerability feed, for instance.
  • Update itself. A new release is installed by the operator when they have time. A compliance system that changes unnoticed is a contradiction in terms.
  • Move to the cloud. A manufacturer's records belong to the manufacturer. There is no hosted edition.

What it is not

Not legal advice. CRA-Akte classifies what follows from the data entered and the stored criteria, and makes the reasoning traceable. The legal assessment and the responsibility for accuracy, completeness and meeting deadlines remain with the manufacturer.

Not a substitute for a process. The tool records who decided what, and when. Who reports in an emergency — and who stands in when that person is on holiday — remains an organisational decision.

Sources

Interested?

CRA-Akte is built at Techlogia and used there as well — our own product file lives in our own system. If you are facing the same deadline: write to us. We will tell you what holds today and what does not yet.