Copla launches Cyber Resilience Act compliance framework

Copla said its framework splits the CRA's secure-by-design and vulnerability-management demands into discrete tasks and adds a structured readiness plan. It also supplies templates for technical documentation and the EU Declaration of Conformity. The CRA framework joins Copla's existing support for DORA, NIS2, ISO 27001, SOC 2 and PCI DSS.

Other vendors offer CRA compliance tooling. ArmorCode announced CRA capabilities within its Agentic AI Platform in June 2026, including SBOM and VEX support and disclosure workflows. exida released exSILentia CRA on 3 November 2026, a tool for product risk assessments and technical documentation.

The 2027 sales gate

From 11 December 2027, products lacking a valid declaration of conformity and CE mark may not legally be sold in the EU, and national market surveillance bodies will have powers to demand withdrawals or recalls. The CE mark, already familiar from toys, kettles and chargers, then extends to software. Manufacturers must sign an EU Declaration of Conformity before displaying the mark. The regulation entered into force on 10 December 2024, and its chapter on notified conformity assessment bodies has applied since 11 June 2026.

Reporting duties already apply

The European Commission says Article 14 has applied since 11 September 2026. A manufacturer that learns of an actively exploited vulnerability must file an early warning within 24 hours and a detailed notification within 72 hours. A final report is due within 14 days of mitigating an exploited vulnerability, or within one month of the 72-hour notification for severe incidents. Submissions go through ENISA's Single Reporting Platform, which routes a single filing to the agency and to the CSIRT coordinator determined by where the manufacturer's EU main establishment sits. The platform launched without an API, so every report is filed by hand through a web portal.

Article 69(3) extends Article 14's reporting duties to in-scope products already on the EU market, even though most other CRA requirements are grandfathered for pre-2027 products. Reporting obligations also continue after a product is no longer supported, which keeps legacy systems and third-party components in scope. Breaches of the core security rules can cost up to €15m or 2.5% of global annual turnover, whichever is higher.

ENISA finds a preparation gap

ENISA published its first SME-focused CRA study in June 2026, surveying 194 organisations in 31 countries. It found that 66% of respondents knew about the regulation, but only about one in three used a software bill of materials. Incident response and product lifecycle management ranked as the weakest area regardless of company size. ENISA cautioned that participation was voluntary and probably tilted toward SMEs already following the issue, meaning actual readiness could be lower still.

Copla chief executive and co-founder Aurimas Bakas said: "ENISA's findings show that awareness is there, but the practical groundwork often isn't yet. An SBOM, a vulnerability handling process and an incident response plan take time to put in place properly, and the reporting obligations already apply today. Companies that start now still have a realistic window to get there before December 2027, and that's what we want to help them do."

Documentation and guidance

Manufacturers must also produce a software bill of materials, a structured inventory of the components inside a product. Publishing it is not required, but market surveillance authorities can demand to see it. Germany's BSI TR-03183 offers a formatting template; it is explicitly non-binding and creates no legal presumption of conformity. The European Commission has published implementation guidance covering product scope, substantial modifications, support periods and reporting obligations.