Clateway Insights platform
EU Cyber Resilience Act compliance
The EU Cyber Resilience Act (CRA) sets cybersecurity requirements for products with digital elements placed on the EU market, with vulnerability reporting obligations from September 2026 and full application from December 2027.
Clateway Product Security gives manufacturers one place for the CRA evidence: every product and version, its software bill of materials, matched security advisories, threats and mitigations, pen tests, conformity documents and the requirement checklist.
Request access to Clateway Insights
Features
- Product and version registry with EU market placement dates
- CycloneDX SBOM import with quality scoring and comparison
- CSAF advisory feeds matched against your components
- AI threat modelling from the SBOM with MITRE ATT&CK techniques
- Pen test reports and conformity documentation
- CRA requirement checklist and evidence bundle
Frequently asked questions
When does the Cyber Resilience Act apply?
The CRA entered into force in December 2024. Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026, and the main obligations from 11 December 2027.
Does the CRA require an SBOM?
Yes. Manufacturers must identify and document the components of their products, including by drawing up a software bill of materials in a commonly used, machine-readable format.
Compare vendors
Key terms explained
- What is the Cyber Resilience Act (CRA)?
- What are CVE and CVSS?
- What is an SBOM (software bill of materials)?
- What is CSAF (Common Security Advisory Framework)?
Related solutions
- Vulnerability management – Scan your systems and technologies for CVEs, prioritise with EPSS and CISA KEV, track SLAs, sync Dependabot alerts and watch SaaS vendor advisories in one…
- GRC and compliance software with AI – AI-powered GRC software: generate ISO 27001, NIS2, DORA and GDPR policies, run your Statement of Applicability, controls, audit findings and management review…