Ready for the Cyber Resilience Act reporting obligation
We monitor your security mailbox around the clock. AI filters out spam, beg bounty e-mails and scanner reports, and you only hear from us when a report matters: by SMS and e-mail, at night too. Whoever takes the case confirms awareness with one click, and from then on the tool shows the 24-hour deadline.
For manufacturers of machinery, devices and software. AI hosted in Germany, GDPR-compliant: your e-mails never go to OpenAI, Anthropic or Google. EUR 190 per month including VAT.
Of 38 e-mails to security@, one was important. Only for that one was anyone alerted.
One in two German industrial companies has no point of contact for security reports from outside.
PwC Product Security Survey 202662 per cent cite the 24-hour deadline as a difficulty.
ONEKEY IoT & OT Cybersecurity Report 20263 in 10 companies know what the Cyber Resilience Act means for them.
Bitkom, September 2026
Finding the needle in the haystack
We read your security mailbox so you don't have to. A security mailbox has to be easy to find. Software finds it too: begging e-mails asking for a bounty, unverified scanner reports, machine-written reports, advertising. Somewhere in between sits the one e-mail that matters, often inconspicuous, in another language or as a polite question from a customer.
- What matters is at the top.Fixed rules and an AI classify every e-mail and give the reason in one sentence. When in doubt, an e-mail counts as important.
- The rest stays quiet.Bug bounty, advertising and customer queries sit below, each with a tag. Nobody is alerted for them, and nothing is deleted.
- Traceable.Every classification is recorded in the history with its reason. Only a person can downgrade, and only one e-mail at a time.
AI, but GDPR-compliant
- Hosted in GermanyThe AI runs on our hosting provider's servers in Germany.
- No e-mail text to AI providersNothing goes to OpenAI, Anthropic, Google or any other AI service.
- No trainingYour e-mails are never used to train an AI model.
- Covered by contractData processing agreement under Article 28 GDPR included.
At the open-source project curl, only around 5 per cent of submissions in 2025 were valid reports. There are no public figures for the mailboxes of mid-sized manufacturers; with the reporting obligation, many of them can be found by machines for the first time. How to handle spam in the security mailbox or see how the tool sorts it.
The reporting obligation already applies.
Since 11 September 2026, manufacturers of products with digital elements have had to report actively exploited vulnerabilities and severe incidents. From 11 December 2027, all other obligations of the Cyber Resilience Act apply.
- AwarenessThe clock starts with awareness, which under the Commission guidance means once the initial assessment is complete.
- 24 hoursEarly warning to ENISA and the competent CSIRT, in Germany CERT-Bund.
- 72 hoursNotification with details of the product, the vulnerability, the exploitation and the first measures taken.
- 14 daysFinal report, counted from the day a corrective or mitigating measure is available.
Article 64 provides for administrative fines of up to EUR 15 million or 2.5 per cent of total worldwide annual turnover; under Article 71, these fines apply from 11 December 2027. The reporting obligation in detail, with a deadline calculator.
Does the CRA apply to you?
Nine questions, three minutes, an instant result. Start with the first question: what do you place on the market?
What you see when it matters
Two places, no training needed: the start screen with everything important, and the settings. Every button explains itself in one sentence, and important buttons ask before they act. On your phone as well as on your computer.
Sample screens. Manufacturer, people and reports are fictitious.
A clear division of tasks
The tool keeps you ready. The decision and the notification to the authorities stay with you; the Regulation places the reporting obligation on the manufacturer (Article 14(1)).
What the tool does
- MonitorYour security mailbox, by forwarding or with read-only access. The tool never replies, moves or deletes anything.
- RecogniseFixed rules for authorities, exploitation, extortion and unreadable e-mails, plus an AI hosted in Germany. No e-mail text goes to OpenAI, Anthropic or Google. The AI may only escalate, never hide anything.
- AlertSMS and e-mail to your people, around the clock or during office hours, set per person. Once per e-mail, bundled when a lot arrives at once.
- DeadlinesFrom confirmed awareness: early warning, notification and final report with date and time.
- HistoryReceipt, alert, who took the case on and awareness, each with a time stamp, exportable at any time.
- Test alertChecks that the messages get through and reminds you when the next one is due.
Set it up yourself, no IT project
Five steps in the browser, ending with a test e-mail and a test alert. If you prefer, we go through the set-up with you.
- Create an accountWith your business e-mail address. The first 30 days are free.
- Connect the mailboxForwarding to a virtual mailbox, or read access via Microsoft 365, Google or IMAP. A test e-mail checks the connection.
- Company profileA questionnaire about your products, services and the components they contain. It tells the tool which reports concern you.
- Add peopleWho is alerted by SMS or e-mail, around the clock or during office hours.
- Test alertEveryone confirms receipt. From then on, monitoring is live.
Example: people
| Who | Channels | Reachable |
|---|---|---|
| Product security | SMS, e-mail | always |
| Development | SMS | always |
| Support | office hours | |
| Management | office hours |
If an important e-mail arrives at 23:00, product security and development get an SMS straight away; support and management find out the next morning if the e-mail is still open by then. Once someone takes it on, everyone else knows. There is no repeat alert: the tool shows in yellow and red how long an e-mail has been waiting.
Pricing
One price, everything included: any number of people, SMS, e-mail, classification by the AI hosted in Germany and the data processing agreement under Article 28 GDPR. All prices include VAT and are billed via Stripe.
- CRA Response Center
- EUR 190 per month
- One monitored mailbox. EUR 1,900 per year, two months free. The first 30 days are free, and you can cancel monthly.
- Additional mailbox
- EUR 30 per month
- For psirt@, csirt@ or a second security mailbox. EUR 300 per year. You choose, person by person, who is alerted for it.
- Set-up with us
- Fixed price
- If you prefer, we go through the questionnaire, people and test alert together with you. We quote the fixed price after the first conversation.
Launch phase: pilot customers get special terms and help decide what we build next.
Frequently asked questions
Does the CRA apply to us at all?
It applies to manufacturers, importers and distributors of products with digital elements: the machine with remote maintenance, the device with an app, the software you sell. Pure cloud services with no installed component are generally not covered. The Applicability Check gives you an initial assessment, and in the first conversation we go through your products together.
Does every reported flaw have to go to the authorities?
No. What must be reported are actively exploited vulnerabilities and severe incidents. But whether a flaw is being exploited only becomes clear once it has been assessed. That is why every report has to be looked at quickly, at night too.
Who gets woken at night?
Your own people, and only for important e-mails: when a report points to an attack on or a flaw in your product, in cases of extortion, when a CERT or an authority writes, or when an e-mail cannot be read. Whoever is set to "always" is alerted, by SMS or e-mail, once per e-mail. Anyone who chose "office hours only" finds out the next morning if the e-mail is still open by then. If nobody is set to "always", the tool warns you, because the 24-hour deadline could otherwise run out unnoticed.
How does the tool recognise what matters?
In two stages. Fixed rules catch clear-cut cases: mail from authorities, claimed exploitation, extortion, encrypted e-mails, notices from suppliers. In addition, an AI recognises signs of vulnerabilities, even in clumsy English, in German or as a polite question from a customer. It knows what your products, services and components are from the questionnaire you complete during set-up. The AI may only escalate; only a person can downgrade, and only one e-mail at a time. When in doubt, an e-mail counts as important.
Where are our e-mails stored, and who reads them?
The tool and the AI run at a hosting provider in Germany. Your e-mails never go to OpenAI, Anthropic, Google or any other AI provider; classification takes place entirely on servers in Germany. Your e-mails are never used to train AI models. E-mail texts are stored encrypted: all of them for 30 days, important ones until three months after they are marked Done, after which only sender, subject and history remain. We only see content if you grant us access for a support case, and every access is recorded in the history. The original stays in your mailbox. You conclude the data processing agreement under Article 28 GDPR during set-up; it lists the sub-processors.
Do you submit the notification for us?
No. Submission goes through the ENISA portal and is the manufacturer's responsibility, carried out by a designated person with their own access. The tool shows the deadlines from confirmed awareness and records who did what and when. Templates for the content of the notification are in the free CRA Reporting Kit.
What happens to bulk e-mails and false reports?
Security mailboxes attract automated reports, often combined with a request for a reward (beg bounty). Nothing is deleted: such e-mails land under Everything else with the tag Bug bounty, and nobody is alerted. If a report contains any sign of exploitation, fixed rules keep it important. You write the replies to reporters yourself; the guide Spam in the security mailbox explains how.
Are you a public authority or connected to one?
No. CRA Response Center is a private service provider and is not affiliated with ENISA, the German BSI or the European Commission. Nor do we replace legal advice.
Guides to the Cyber Resilience Act
Guides for management: the reporting obligation, the ENISA platform, security.txt, product classes, deadlines, fines. Every guide cites the articles of the Regulation and its sources. Plus a glossary of terms, an overview of what is changing right now, and free tools: the CRA Reporting Kit with templates, the Applicability Check, the security.txt generator and the security.txt checker.
- EN 40000-1-1 and EN 40000-1-2 have passed the formal vote, but no standard is in the Official Journal yetAccording to secondary sources, the first two CRA standards have been approved. There is still no presumption of conformity.
- Germany's CRA implementation act is stuck in the Committee on Internal AffairsNo objections from the Bundesrat, with the Committee on Internal Affairs since June, not on the October agenda. What is still missing.
- ENISA FAQ of 3 October 2026: the 72-hour counter on the platform shows 48 hoursThe platform counts the 72-hour deadline from the early warning. A field for the time of awareness is still missing for vulnerabilities.
Trial or demo
Try it free for 30 days, or let us show you how it works in a short video call. We will get back to you by e-mail with the next steps.
- How an important e-mail is handled, from receipt to deadline
- Your products and whether the CRA applies to them
- Trial access, set-up and the terms for pilot customers