Is this legal advice?

No. PartsProof is a documentation and readiness service. We build your process artifacts from the regulation’s published text and ENISA guidance. For legal questions about your specific exposure, talk to counsel — our scope memo gives them a running start.

Does this make my product CE-compliant?

No, and be wary of anyone who says a document pack can. Full conformity (Annex I, CE marking) lands December 11, 2027 and involves real security engineering. This pack covers the September 11, 2026 reporting obligations completely, and the included gap checklist shows exactly what 2027 will ask of you.

I already sell in the EU. Does the deadline still apply to me?

Yes. Article 14 applies from September 11, 2026 to every in-scope product, including ones placed on the market before then, and the duty outlives the support period. It is not retroactive reporting, though: Commission guidance of July 27, 2026 confirms you owe nothing for exploitation you had already become aware of before that date. The clock runs on what you learn from September 11 onward.

What exactly do I have to report?

Two things: actively exploited vulnerabilities in your product, and severe incidents affecting its security. Each triggers the cascade — early warning in 24 hours, notification in 72, final report in 14 days (vulnerabilities) or a month (incidents) — filed once through the CRA Single Reporting Platform, addressed to the CSIRT where you have your main establishment. The runbook walks each step with the forms pre-drafted.

What’s an SBOM and why do I need one?

A software bill of materials — a machine-readable list of every component and dependency in your product. It’s how you answer “are we affected?” in minutes instead of days when a dependency CVE drops, and it’s expected under the CRA’s vulnerability-handling requirements.

My product is mostly open source. Am I exempt?

Only if it’s outside commercial activity. The moment you charge for the product, support, or hosting, you’re a manufacturer under the CRA. Open-source stewards get a lighter regime — the scope checker walks that edge case.

PartsProof alternatives: free tools, a platform, or a consultant

Not every maker needs a paid readiness pack. Here is what a small hardware or software maker actually gets from the free route, the platform route, and hiring a consultant, quoted from each one's own page.

The free route: generate the SBOM yourself

Anchore’s Syft and equivalent open-source tools (Trivy, GitHub’s own Dependency Graph) generate a software bill of materials from a codebase or a container image at no cost, read live on 4 September 2026. What they do not produce is the vulnerability disclosure policy the Cyber Resilience Act’s reporting duties assume exists, or the 24-hour incident runbook with the actual deadlines written in. The SBOM is one of the three documents the SBOM rule describes; the other two are written work, not a scan output.

The platform route: FOSSA

FOSSA, read live on 4 September 2026, sells continuous dependency scanning at “$20 per project per month, billed annually” for its Business tier, generating an SBOM as one output alongside license and vulnerability checks across the dependency tree. The full comparison is here. It is built to run against a codebase continuously rather than to produce a one-time reporting-readiness pack, and it states no disclosure-policy or incident-runbook deliverable.

The consultant route

A cybersecurity consultant can write a disclosure policy, SBOM process and incident runbook for a specific product. This work is quoted per engagement and firms in this category generally do not publish rates, so no price is stated here. It is the right buy once the question turns genuinely novel: a disputed classification, a multi-product portfolio with different risk classes, or an actual incident. For a single product on a routine timeline it is an expensive way to obtain three standard documents.

Where PartsProof fits

PartsProof is for the maker who needs the disclosure policy, the SBOM and the 24-hour runbook done together, once, before 11 September 2026. $79 for the Readiness Pack, $149 for Readiness Plus, $299 for Readiness + Retainer, flat fee, no scanning platform and no recurring seat. See every option on one grid.

PartsProof does not run continuous dependency scans and is not a law firm. Every figure above is what the named page stated on 4 September 2026 and is linked so it can be checked directly; prices change without notice.