If you manufacture, import, or distribute products with digital elements on the EU market — including software, firmware, IoT devices, embedded controllers, or connected hardware — CRA almost certainly applies. This includes components supplied to other manufacturers. Custom software built exclusively for internal use by a single client is generally excluded.

September 11, 2026 — mandatory vulnerability reporting (24h early warning to ENISA). December 11, 2027 — full compliance required (security-by-design, SBOM, CE marking, lifecycle documentation). Products not meeting these deadlines cannot legally be placed on the EU market.

Non-compliance can result in fines up to €15 million or 2.5% of global annual turnover, product withdrawal from the EU market, and significant reputational damage. Your customers may also drop non-compliant suppliers from their supply chains well before the regulatory deadline.

No. It is a structured assessment — not a formal audit like ISO certification. We evaluate your processes, tools, and work products against CRA-aligned expectations and deliver a prioritized gap analysis with a remediation roadmap. It’s a practical engineering review designed to tell you exactly where you stand and what to fix — not a pass/fail certification exercise.

ISO 27001 focuses on information security management systems (ISMS) at an organizational level. CRA compliance is product-specific — it requires demonstrable evidence for each product: SBOM, vulnerability handling, security-by-design, CE conformity, and lifecycle support. Our assessment specifically targets these product-level CRA requirements.

A typical CRA Compliance Check is completed within one week: kickoff (day 1), evidence collection (days 2–3), stakeholder workshops (days 3–4), and findings validation plus roadmap delivery (day 5). Complex multi-product assessments may take 1–2 weeks.

We provide a structured list of evidence requests at kickoff. Typical items include SBOM samples, vulnerability-tracking records, CI/CD pipeline configurations, release procedures, and security policies. Where needed, we involve your engineers in short, focused touchpoints to clarify how your product actually works, so we can interpret the evidence correctly. We work with read-only access and lightweight workshops to minimise disruption to your day-to-day work.

The Cybersecurity Risk Assessment (CS RA) Workshop is a moderated session where we guide your team through a structured risk analysis for your product(s). CRA explicitly requires documented risk assessments. If you don’t have a formal one for each product, you’ll need one. Our workshop delivers this in a week.

You receive a complete deliverable package: executive summary, detailed findings, and a prioritized 30/60/90-day remediation backlog. You can self-remediate, engage Codelab for implementation sprints, or set up an ongoing retainer for continuous compliance support.

Absolutely. Unlike pure consulting firms, Codelab has 220+ engineers who can help you execute: build pipelines, deploy toolchains, implement security processes, create documentation frameworks, and support your teams through the transition.