Cyber Resilience ActClassify your products, map the Annex I requirements and set up vulnerability reporting, supported by our agents. A compliance engineer helps you prepare for the audit.
30 minutes, on your own setup. We show you what the CRA means for your products.
Hosting in the EU or USOur agents support every step. You make the decisions.
Answer a few questions about your products with digital elements, their category and their support period. GetTeddy classifies each product and shows which conformity route applies.
Cyber Resilience ActAsking a few questionsProducts classifiedWhich products?Which category?Which support period?Our Gap Audit Agent checks each product against the security requirements and vulnerability handling rules in Annex I. You start with a clear list of what is missing, each item with an owner.
Cyber Resilience ActGap audit runningGaps foundGetTeddy drafts your vulnerability disclosure policy and assembles the technical documentation. SBOMs and other evidence flow in from your tech stack and land on the right requirement. Your team reviews and approves.
Cyber Resilience ActBuilding the technical fileDocumentation linked
Reporting obligations have applied since 11 September 2026, the full requirements apply from 11 December 2027. GetTeddy sets up the 24-hour and 72-hour reporting steps and prepares your EU declaration of conformity, and a compliance engineer helps you prepare for the audit.
Cyber Resilience ActPreparing conformityReady for conformityThe same result, without months of spreadsheets and consultant hours.
| Consultants and spreadsheets | GetTeddy | |
|---|---|---|
| Product classification | Legal review per product | Supported by our agents |
| Annex I requirements | Generic checklists | Mapped to your controls |
| SBOMs | Collected by hand | Tracked per product |
| ISO 27001 or NIS2 | Separate projects | Built on the same controls |
| Ongoing | Yearly review | Gap audits every week |
The reporting obligations have applied since 11 September 2026. Most other obligations apply from 11 December 2027.
Products with digital elements placed on the EU market, such as software and connected hardware. GetTeddy checks which of your products are in scope.
A software bill of materials lists the components in your product. The CRA requires you to identify and document them.
Partly. Secure development and vulnerability handling overlap, and GetTeddy maps your existing controls so you only work on the gaps.
In the region you choose, the EU or the US. Your data is kept separate from other customers and encrypted, and GetTeddy does not train AI models on your data.
Ready when you areSee what the CRA means for your products in a 30-minute demo.
Book a demo