EU Cyber Resilience Act Compliance
We support CRA compliance for businesses entering the EU market and product companies.
Why us
Supporting cybersecurity since 2018
We take a systematic approach to cybersecurity policies and processes, from the GDPR to the CRA
-
A cornerstone of our practice: technical measures for data protection compliance
-
10+ years of experience in IT
We have supported clients with breaches, documentation and audits -
Working with German partners
We implement leading European practices
Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track –
-
01
CRA Applicability Assessment
We assess whether your company falls within the scope of the regulation and which obligations it must fulfil -
02
CRA Gap Assessment
We review your current cybersecurity programme (processes and documentation) and prepare an action plan -
03
CRA documentation
We help develop the required vulnerability management policies, user manuals, declarations of conformity and other documentation -
04
CRA processes
We support the adaptation of product architecture and functionality, the development of new products and the discontinuation of support for older ones -
05
CRA incidents
We prepare you to notify supervisory authorities of breaches and respond to subsequent regulatory action, and support the mitigation process -
06
CRA training
We explain the CRA requirements in detail using your organisation as an example, covering the EU regulatory landscape and the consequences of non-compliance -
07
CRA support
We support applications for SME assistance with conformity assessments, responses to requests from regulators and users, vendor assessments and much more
what is included? – what is included? – what is included? – what is included? – what is included? – what is included? – what is included? – what is included? –
Processes
Documents
-
Vulnerability management
We help establish processes for disclosing, receiving and handling vulnerability information -
Vendor / supplier due diligence
We assess suppliers of components, manufacturers, importers and distributors -
Outsource compliance checks
We review open-source stewards' documentation for compliance with the CRA requirements – and more -
Incident and risk notification
We support notifications to regulators, manufacturers and users about identified vulnerabilities and non-technical risks -
Modification and sunsetting management
We help you assume the role of product manufacturer following a product modification and discontinue support for previous product versions -
Bugbounty programs
We support the design and implementation of bug bounty programmes -
Update management
We help prepare update release documentation, product change notices and responses to users' queries about updates -
Regulator relations
We support your company in communications with CSIRTs, ENISA, data protection authorities, market surveillance authorities and notified bodies on risks, vulnerabilities, incidents and other matters
-
Cybersecurity risk assessment
We help identify and assess risks and develop risk mitigation strategies for data, systems and their components -
Vulnerability disclosure policy
We draft internal and external vulnerability management policies and support their implementation -
User instructions and manuals
We help prepare clear, accessible information about security measures for instructions, manuals, notices and other user-facing materials -
Technical documentation
We support the preparation of the technical documentation package required to place products on the EU market -
Declaration of conformity and CE marking
We help prepare the declaration of conformity and its simplified form, and guide you through assessment by the responsible authority or certification body -
Update and patch information
We draft notices explaining the content of updates and patches, and assess whether an update should be deferred -
Support period calculation
We analyse local regulatory requirements, recommended support periods and competing products, and document our assessment -
Notification to users and authorities
We help draft and send notifications to authorities, manufacturers and users on various CRA compliance matters – and more
How do we implement this?
-
Updated roles and responsibilities
We identify roles and responsibilities, support existing processes and establish compliance processes – both internal and those for dealing with regulators and users. -
Documents, processes and evidence
We organise risks, record the results of audits and assessments, prepare documents, track their update and review dates, support periods and other relevant information -
Team training
We deliver online training and prepare accompanying tests for your team, taking your industry, market, products and business context into account -
CRA support on a case-by-case basis
We can agree on further involvement for specific cases or projects as and when needed
How much does it cost?
€120/hour
Depending on the complexity and specific requirements of your request
Team
Key data protection specialists
From discovery to a structured compliance dashboard. Who can help?
Certified experts
Certifications in the field of data protection
Internationally recognised expertise
Up-to-date and useful articles
- Data protection officer
- AI compliance officer
- Data privacy compliance
- Diia.City
- Digital Millennium copyright Act
- Trademark in IT
We write about what we practise
IP, GDPR, contracts and disputes, as well as the legal aspects of implementing technologies such as artificial intelligence and best practices for implementing specific legal solutions.
-
- Data privacy compliance
Cybersecurity risk assessment: How manufacturers can prove compliance with the CRA
Мевша Аліса -
- Data privacy compliance
Encryption and Key Protection: Does Encryption Exempt You from Security Incident Notification Obligations under the GDPR and CRA?
Євгеній Кандирал -
- Data privacy compliance
EU Compliance for Technology Products in 2026: AI Act, GDPR, EAA, and PLD
Антон Тарасюк -
- Data privacy compliance
CCTV vs. Privacy: GDPR Rules for your cameras
Legal IT Group