available
Industry template: Manufacturers
- Cyber Resilience Act per product up to CE marking
- Radio Equipment Directive with EN 18031
- Vulnerability management with SBOM
from €427 per month plus VAT in the Start package, size S, annual payment
Who it’s for
Complass for product development
You are responsible for, or develop, a product with software or a network connection. With the Cyber Resilience Act, security becomes part of the product requirements, across the whole life cycle. Complass manages the requirements per product, links them with SBOM and vulnerabilities and keeps the reporting deadlines in view.
The challenge
Security across the life cycle
It is not only the release that counts: updates, support period and vulnerability handling are part of conformity.
Third-party components
Open source and purchased components bring their own vulnerabilities. Without an SBOM there is no overview.
Short reporting deadlines
Actively exploited vulnerabilities and severe incidents require an early warning within 24 hours.
What the CRA requires of manufacturers
For products with digital elements, among other things:
Frameworks: CRA · Radio Equipment Directive · IEC 62443 · Machinery Regulation
- Meet the essential cybersecurity requirements, with risk assessment, technical documentation and due diligence for third-party components Art. 13 CRAArticle 13 Cyber Resilience Act Obligations of manufacturers1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I. 2. For the purpose of complying with paragraph 1, manufacturers shall undertake an assessment of the cybersecurity risks associated with a product with digital elements and take the outcome …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
- Handle vulnerabilities during the support period, maintain an SBOM and provide security updates Art. 13 CRAArticle 13 Cyber Resilience Act Obligations of manufacturers1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I. 2. For the purpose of complying with paragraph 1, manufacturers shall undertake an assessment of the cybersecurity risks associated with a product with digital elements and take the outcome …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
- Report actively exploited vulnerabilities and severe incidents: early warning after 24 hours, notification after 72 hours, then a final report Art. 14 CRAArticle 14 Cyber Resilience Act Reporting obligations of manufacturers1. A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that actively exploited vulnerability via the single reporting platform established pursuant to Article 16. 2. For the purposes of …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
How Complass helps
CRA per product
Implement requirements per product and version, from risk assessment to technical documentation and CE marking.
More about this featureSBOM and vulnerabilities
Import the SBOM, find and assess known vulnerabilities of the components, with deadlines up to the update.
More about this featureReporting deadlines
Check whether a report under the CRA is required and track the deadlines with a countdown.
More about this featureEvidence secure development
Document processes for secure development, testing and vulnerability handling, for example according to IEC 62443-4-1.
More about this feature
Matching offers
The Manufacturers industry template preselects the CRA, the Radio Equipment Directive and vulnerability management with SBOM.
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
Frequently asked questions
Does our product fall under the CRA?
The CRA applies to products with digital elements made available on the EU market, with exceptions for example for medical devices and vehicles. The free check gives a first assessment.
Which SBOM formats are supported?
CycloneDX and SPDX. The components are matched against known vulnerabilities.
How are product development and the company connected?
The CRA concerns your products, NIS2 your company. In Complass you manage both in one account and use shared measures.
Read on
Further reading
Cyber Resilience Act für Hersteller von Hardware und Software
View white paperSecure Development für Hersteller
View white paperOther job roles and sectors
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.