Because the file has to evolve with every release. As code it stays current and verifiable, instead of a document that goes stale.

Is our SaaS in scope of the CRA?

Pure SaaS is in principle outside the CRA. That changes when your service is the remote data processing without which a product with digital elements (an app, a device, software you ship) cannot perform one of its functions: then it belongs to that product. In the introduction I hold your products against that definition.

Available from the first quarter of 2027

CRA technical file

The technical documentation the Cyber Resilience Act requires per product, built as code.

For whom

Manufacturers and importers of products with digital elements: hardware with software, apps, connected devices.

Why now

From 11 September 2026, actively exploited vulnerabilities must be reported; from 11 December 2027 the regulation applies in full.
By then the technical file, the vulnerability policy and the software bill of materials (SBOM) must exist per product.

What you get

Technical documentation following Annex VII of the regulation, maintainable as code.
Software bill of materials (SBOM) process and its link to your build.
Coordinated vulnerability disclosure policy and reporting procedure.
Draft EU declaration of conformity for products that may be self-assessed.

Not included

Conformity assessment by a notified body (for important and critical products).
Penetration testing and technical hardening.

Frequently asked questions

Why as code?: Because the file has to evolve with every release. As code it stays current and verifiable, instead of a document that goes stale.
Is our SaaS in scope of the CRA?: Pure SaaS is in principle outside the CRA. That changes when your service is the remote data processing without which a product with digital elements (an app, a device, software you ship) cannot perform one of its functions: then it belongs to that product. In the introduction I hold your products against that definition.