arrow_circle_right CRA COMPLIANCE SOFTWARE
CRA Compliance Portal: Review your EU Cyber Resilience Act readiness in minutes
Turn your products into evidence register – a traceable, reviewable documentation your team can review and keep every approval in the audit trail.
Spyrosoft’s CRA Compliance Portal shows you, product by product, which evidence you have and which is still missing.
The CRA applies in full 11 December 2027. The maximum penalty is up to €15 million or 2.5% of worldwide annual turnover, whichever is higher.
arrow_circle_right OUR CERTIFICATES
arrow_circle_right THE RISK
The deadline is regulatory, but the cost is already operational
Market access
A product line without the required CE marking can’t generate EU revenue.
Engineering time
Your engineers assemble evidence by hand instead of working on the next release.
Speed of answer
For reportable vulnerabilities, the clock runs in hours. Manual impact checks can’t take weeks.
Commercial pressure
SBOM requirements are already showing up in customer and tender requests.
arrow_circle_right THE SOLUTION
Get your evidence register with CRA Compliance Portal
Our portal uses AI agents and open-source tools against your product and organises their outputs as evidence in one register across all your products. You see what’s covered, what’s missing, and who approved what.
You declare conformity and carry the liability as the manufacturer. The portal keeps the evidence that supports your declaration. The agent can prefill the EU declaration of conformity, and you review and sign the final document.
| The CRA Compliance Portal is | The CRA Compliance Portal is not |
|---|---|
| One evidence register across all your products | A tool that decides legal conformity |
| Agents and open-source tools whose outputs become evidence | Another scanner added to your tool list |
| A clear view of which evidence is still missing | A PASS verdict or a compliance score |
| An append-only audit trail | A system that changes your repository |
| Agents draft, your team owns and signs | A system that signs on your behalf |
arrow_circle_right HOW IT WORKS
AI agents prepare the evidence, your team approves it
Seven steps take you from product setup to an audit-ready package. You make the decisions at the start. Agents do the assembly after that, and every proposal waits for a person to approve it.
Product and release
You set the CRA role and product class once.
Entry mode
You choose repository mode or SBOM mode.
Tools and agents
AI agent runs open-source analysis tools and logs any that fail.
SBOM and components
AI agent reads the code when manifests are missing.
Vulnerabilities and triage
AI agent adjusts severity to your product’s context.
Risks and remediation
AI agent drafts the fix and the diff for your review.
Evidence, documents, and incidents
AI agent prefills the declaration of conformity.
arrow_circle_right CAPABILITIES
Focus on reviewing instead of assembling
A CRA SBOM, even without manifests
Agents read your source code when manifests are missing and return each component with its source and a confidence level. You see exactly where the inventory is still incomplete.
Severity that fits your product
The agent proposes a contextual severity and explains its reasoning. A CVSS 9.1 issue in a tool that never ships doesn’t automatically stay 9.1 for your product.
Requirements mapped honestly
Each finding is mapped to the CRA requirements it affects. If there’s no defensible link, the field stays empty instead of guessing.
Fixes you apply yourself
You get a proposed patch and diff to copy into your own repository. The portal never writes to it.
CRA vulnerability reporting clocks
A finding flagged as actively exploited opens a reportable case. You track the 24-hour early warning, the 72-hour notification and the final report from the moment you became aware.
Documents with their history
Agents draft evidence documents. You version and approve them, with the decision history attached.
An audit trail you can export
Every approval of an agent proposal is kept in an append-only record. Export the audit package whenever you need it.
Gaps on the record, not hidden
If a tool fails, the agent lists it and explains why. The portal records the gap in audit coverage as a finding.
A shorter path for importers
Placing third-country products on the EU market? You get a shorter checklist built on importer obligations under Article 19, instead of the full manufacturer set.
arrow_circle_right INSIDE THE TOOL
CRA Compliance Portal, from the inside
arrow_circle_right DATA CONTROL
You decide how much code you share
Your legal and IT security teams will ask where source code goes. The answer is your choice. In SBOM mode, your source code never reaches Spyrosoft.
| Capability | SBOM mode | Repository mode |
|---|---|---|
| Components, licences, and completeness | Yes | Yes |
| CVE matching and triage | Matches CVEs, doesn’t check whether affected code is used | Matches CVEs and checks whether affected code is used |
| Static application security testing (SAST), secrets, attack surface, and hardening | No | Yes |
| Suggested fix with a diff | No | Yes |
| Evidence generated from analysis | SBOM only | SBOM plus source analysis |
It fits your environment without changing it
- Connect GitHub or GitLab read-only, or upload an SBOM with no repository access at all.
- No branches, no merge requests, and no CI runs.
- Export findings to Jira and the audit package as a file.
- Choose the AI provider, vulnerability sources, triage threshold, and analysis cost limit.
- Set a limit on AI analysis spend, so you know what a run can cost before it starts.
Run it where you want, operated by whoever you want
- Where it runs: any public cloud you choose, your own servers or private cloud, or SBOM-only mode with source code never leaving your environment.
- Who operates it: Spyrosoft handles updates, monitoring, and vulnerability feeds, or your IT team runs it with releases and support from Spyrosoft.
- Who reviews it: auditors get read-only access to reports and audit documents, with no edit rights.
arrow_circle_right ABOUT US
Built by engineers who work inside these codebases
Spyrosoft builds embedded software and HMI software for connected-device manufacturers, inside the same codebases the CRA now covers. That’s where the portal came from.
- Shaped by real audits: Spyrosoft’s 2026 open-source and security audits kept finding the same missing component, licence, and security evidence. Those gaps shaped the portal.
- Tested under delivery pressure: you work with a team that has produced audit evidence on client products against real deadlines.
- A portal and a team: need more than the evidence register? The same team covers CRA consulting and gap analysis, from secure by design to vulnerability disclosure and ENISA reporting.
arrow_circle_right PILOT
Start with one product line
Start with a pilot on one product, so you see how it works on your own product before you roll it out further.
You’ll get a component inventory, a triaged vulnerability list, a readiness report, and a list of missing evidence.
Pilot, four to six weeks
Run one product line in SBOM mode, with no source code access, and baseline the missing evidence.
Rollout, one quarter
Add your remaining product lines, enable repository mode where it helps, train your team, and migrate existing approvals.
Run, ongoing
Agents reanalyse each release and propose triage, and your team keeps the audit package current.
arrow_circle_right Our team
Meet our expert
I am a certificated Automotive Consultant with over 15 years of experience in the computer software industry. I have extensive experience in Kaizen, Electronics, Automotive, R&D and Manufacturing gained by working with leading IT companies in Europe. I am also an accomplished professional with an executive MBA focused in Business Administration, Management and Operations from Polish Open University. At Spyrosoft, I support key clients from the Automotive business unit in implementing Functional Safety solutions.
arrow_circle_rightContact us
Make sure you’re ready for CRA
One call is enough to choose the product line and define what a successful pilot looks like for you. You don’t need to share source code to get started.
Przemyslaw Krzywania
HMI Director
arrow_circle_right Our articles
Pick your next read
arrow_circle_right FREQUENTLY ASKED QUESTIONS
FAQ
CRA compliance software helps manufacturers collect, organise, and maintain the evidence the Cyber Resilience Act requires: SBOMs, vulnerability handling records, technical documentation, and incident reports. The CRA Compliance Portal uses AI agents to draft that evidence from your product code, and your team approves each item.
No tool can do that. As the manufacturer, you declare conformity and carry the liability. The portal keeps the evidence that supports your declaration and shows what’s still missing. It doesn’t issue certificates, verdicts, or compliance scores.
The manufacturer does. The portal’s agent can prefill the declaration of conformity from approved evidence, but a person at your company reviews and signs the final document.
CRA vulnerability and incident reporting (the 24-hour early warning and 72-hour notification) has applied since 11 September 2026. The rest of the CRA applies from 11 December 2027.
Yes. Manufacturers must draw up an SBOM in a commonly used, machine-readable format covering at least the product’s top-level dependencies. It forms part of the technical documentation that market surveillance authorities can request.
Not in SBOM mode. You upload an SBOM, and your source code never reaches Spyrosoft. For deeper analysis, repository mode connects to GitHub or GitLab read-only, and you can install the portal on your own infrastructure.