How CRA Evidence started
It started in 2025, when Joan Romero heard about the Cyber Resilience Act for the first time.
From that point he started connecting it to his entire career as a Cloud Engineer and SRE. We are building and shipping more products than ever, but we are not taking care of cybersecurity. Incidents keep growing.
The Cyber Resilience Act exists because of that. Europe saw the problem and decided to act. Joan decided to help teams get through it, and started building CRA Evidence.
That became a reality in 2026. The first chapter was going through CEEI, the European Centre for Business and Innovation of the Principality of Asturias. With their help, the company got started.
Why CRA Evidence was built
More digital products reach Europe every year, from industrial controllers to home devices, and the Cyber Resilience Act is the first EU-wide regulation demanding real security evidence across a product's full life. We wanted to help the teams doing that work.
Nobody clearly owned the Cyber Resilience Act. Not engineering, not legal, not product. We built CRA Evidence so that work has a home: tracked, corrected, and audit-ready across the ten-year-or-longer window the regulation requires.
Products with digital elements placed on the EU market must be designed, produced, and maintained with real cybersecurity evidence across their life cycle, and manufacturers in scope keep the technical documentation on file for at least ten years, or for the support period if that is longer.
Regulation (EU) 2024/2847 · paraphrased
That is the work we build for.
The CRA applies differently to each role. We adapt to each.
Manufacturers, importers, and distributors carry different obligations under the regulation. CRA Evidence ships the right workflow for each.
Manufacturers
You build products with digital elements. The heaviest CRA obligations fall on you.
- SBOM validation against BSI TR-03183
- Continuous vulnerability monitoring with hourly and daily source syncs
- EU Declaration of Conformity generator
- User Information & Instructions (UII) builder
- Version-level compliance tracking
Importers
You bring products into the EU market. You must verify manufacturer compliance before you sell.
- Importer verification checklists
- Manufacturer documentation requests
- Evidence storage with audit trail
- Records for market surveillance
Distributors
You sell products in the EU but don't manufacture or import them. Lighter obligations.
- Compliance verification workflows
- Product documentation access
- Distributor guidance
- Incident escalation paths
The questions we keep hearing
Every team preparing for the CRA is working through the same basics:
- What format should my SBOM be in?
- How do I track vulnerabilities across 300 dependencies?
- What exactly goes in a technical file?
- How do I prove compliance to a market surveillance authority?
The regulation is complex enough. Your tools shouldn't be.
Independent recognition
Third-party signals you can verify yourself. Read the full announcements in the newsroom.
Visit the newsroom →
Ready to simplify CRA compliance?
Map obligations, generate evidence, and stay audit-ready across all product versions before December 11, 2027.