Free Cyber Resilience Act tools

Four tools on the way to reporting readiness: check whether your product is in scope, publish and verify your reporting address, and set up the incident procedure with ready-made templates.

Free, no account needed. Based on Regulation (EU) 2024/2847 and BSI TR-03183-3, legal status as of 8 October 2026. Not legal advice.

Templates in Word, Excel and PDFCRA Reporting KitEverything that needs to be in place before your first notification: a reporting playbook with roles and procedure, an awareness record, notification templates for the ENISA platform, customer information, a CVD policy, standard replies for the security mailbox, a call chain and a deadline calculator. Sent by e-mail to your business address.Request the kit Nine questions, about three minutesCRA Applicability CheckIs your product covered by the Cyber Resilience Act, which product class is likely, and does the reporting obligation already apply to you? With an assessment of your reporting readiness and the next steps.Start the check Runs in your browsersecurity.txt generatorYour reporting address for vulnerabilities under RFC 9116 and BSI TR-03183-3, every field explained, validated before download. Includes a draft CVD policy.Create the file For files that are already onlinesecurity.txt checkerChecks retrieval, structure, expiry date, references, keys and signature of your security.txt, and tells you how to fix each finding.Check the file

To stay up to date, subscribe to the newsletter: it announces new versions of the kit and changes to the reporting obligation, at most once a month. Background reading is in our Guides section.

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days