Is this legal advice?

No. PartsProof is a documentation and readiness service. We build your process artifacts from the regulation’s published text and ENISA guidance. For legal questions about your specific exposure, talk to counsel — our scope memo gives them a running start.

Does this make my product CE-compliant?

No, and be wary of anyone who says a document pack can. Full conformity (Annex I, CE marking) lands December 11, 2027 and involves real security engineering. This pack covers the September 11, 2026 reporting obligations completely, and the included gap checklist shows exactly what 2027 will ask of you.

I already sell in the EU. Does the deadline still apply to me?

Yes. Article 14 applies from September 11, 2026 to every in-scope product, including ones placed on the market before then, and the duty outlives the support period. It is not retroactive reporting, though: Commission guidance of July 27, 2026 confirms you owe nothing for exploitation you had already become aware of before that date. The clock runs on what you learn from September 11 onward.

What exactly do I have to report?

Two things: actively exploited vulnerabilities in your product, and severe incidents affecting its security. Each triggers the cascade — early warning in 24 hours, notification in 72, final report in 14 days (vulnerabilities) or a month (incidents) — filed once through the CRA Single Reporting Platform, addressed to the CSIRT where you have your main establishment. The runbook walks each step with the forms pre-drafted.

What’s an SBOM and why do I need one?

A software bill of materials — a machine-readable list of every component and dependency in your product. It’s how you answer “are we affected?” in minutes instead of days when a dependency CVE drops, and it’s expected under the CRA’s vulnerability-handling requirements.

My product is mostly open source. Am I exempt?

Only if it’s outside commercial activity. The moment you charge for the product, support, or hosting, you’re a manufacturer under the CRA. Open-source stewards get a lighter regime — the scope checker walks that edge case.

PartsProof vs CRA Evidence: two ways to get ready for EU security reporting

Both products address the Cyber Resilience Act, but they are not the same kind of purchase. CRA Evidence presents a continuously maintained platform for SBOMs, vulnerabilities, VEX and technical documentation. PartsProof prepares a small maker's reporting-readiness documents as a one-time pack.

What does CRA Evidence provide?

CRA Evidence, read live on 12 September 2026, describes a compliance platform for manufacturers, importers and distributors. Its published feature list includes CycloneDX and SPDX SBOM management, HBOMs, automated VEX statements, Annex VII technical documentation, vulnerability monitoring, and an ENISA reporting workflow for the 24-hour, 72-hour and 14-day reporting stages. Its pricing page lists custom pricing by role and a 14-day free trial, rather than a public one-time fee.

How does PartsProof differ?

PartsProof is a reporting-readiness document pack for a small hardware or software maker: a disclosure policy, an SBOM for the product described, and a runbook that records the reporting deadlines. It is a flat-fee purchase, not a vulnerability monitoring platform, product-version database, or ongoing VEX workflow. The product page and checkout show $15 for the Readiness Pack, $19 for Readiness Plus, and $25 for Readiness + Retainer, each presented as a one-time option.

What you compare	PartsProof	CRA Evidence
Commercial shape	One-time readiness pack	Platform with custom role-based pricing
SBOM / HBOM	SBOM prepared for the described product	SBOM and HBOM management, with CycloneDX and SPDX listed
VEX and vulnerability monitoring	Not a stated deliverable	Automated VEX and vulnerability feeds are listed
Technical documentation	Reporting-readiness documents	Annex VII technical documentation is listed
Incident reporting workflow	24-hour runbook	24h / 72h / 14d ENISA workflow is listed

Which CRA readiness option fits a small hardware maker?

A maker that needs a maintained evidence system across releases, suppliers and vulnerabilities should evaluate CRA Evidence's platform capabilities and request its role-based quote. A maker that needs the core reporting-readiness documents prepared once, without adopting a monitoring platform, should evaluate PartsProof's pack. The choice is about operating model, not which product is universally “compliant.”

The legal clock matters to either decision: the EU regulation says Article 14 applies from 11 September 2026, while the main obligations apply from 11 December 2027. Read the CRA reporting timeline for the deadlines and the documents the reporting process requires. Product features and prices above were checked on 12 September 2026 and may change.