CRA Compliance Software: Which Cyber Resilience Act Obligations CE-Copilot Covers
Searching for CRA software turns up two kinds of tools: development tools that generate an SBOM, scan code for vulnerabilities and distribute updates, and compliance software that handles classification, assessment, evidence and reporting. CE-Copilot is the second kind. This guide sets out how far CE-Copilot covers the obligations of the Cyber Resilience Act: obligation by obligation, with the legal reference and the plan.
Coverage, obligation by obligation
Of 25 areas of obligation, CE-Copilot covers 12 and 8 in part; 5 lie outside the software. In all three cases, technical implementation on the machine and responsibility stay with the manufacturer.
Covered in CE-Copilot (12)
The software guides you through the obligation and documents the result.
Checking the scope
Art. 2, Art. 3(1)
The standards finder only proposes the CRA as applicable when the machine description shows a data connection; negated statements do not count, and without evidence the CRA is listed for review. In the cybersecurity module you check the data connection and the exclusions under Article 2, including Delegated Regulation (EU) 2025/1535.
from Starter
Classifying important and critical products
Art. 7, Art. 8, Annexes III and IV
You name the core functionality and tick the applicable categories of Annexes III and IV, with the technical descriptions of Implementing Regulation (EU) 2025/2392. The classification only becomes binding once you confirm it.
from Starter
Obligations by date of placing on the market
Art. 69, Art. 71(2)
The confirmed date decides which obligations apply to a unit: the reporting obligations since 11 September 2026, the full Regulation for placing on the market from 11 December 2027, and likewise after a substantial modification from that day.
from Starter
Determining the conformity assessment procedure
Art. 32
The app derives the permissible procedures from the classification. It reflects that for Class I products without a harmonised standard, common specification or certification scheme, internal control (module A) is not available.
from Starter
Assessing cybersecurity risks
Art. 13(2) and (3)
The scope of the assessment with intended purpose, reasonably foreseeable use, operational environment, assets to be protected and conditions of use, plus threats with measures and residual risk. It builds on the project's interface inventory.
from Professional
Documenting the Annex I requirements
Annex I Parts I and II, Art. 13(4)
A matrix with the wording of each requirement: whether it applies on the basis of the risk assessment, with a justification where it does not, plus implementation and evidence. Part I point (1) and the vulnerability handling requirements of Part II always apply.
from Professional
Third-party components and open source
Art. 13(5)
A component list that flags free and open-source software and records the due diligence evidence for each component.
from Professional
Setting the support period
Art. 13(8) and (19)
The support period with its justification from the expected time of use, a check against the five-year minimum and the end date that users must be told at the time of purchase.
from Professional
Running Article 14 reporting cases
Art. 14(1) to (4), Art. 69(3)
For each case: time of awareness, early warning within 24 hours, notification within 72 hours and the final report, with a status light on the project page, text templates that follow the wording of Article 14, the competent CSIRT and the reference number from the reporting platform. Reported cases cannot be deleted.
from Professional
User information under Annex II
Art. 13(18), Annex II
You maintain the Annex II information once. It appears in the CRA report and in the cybersecurity chapter of the operating instructions (add-on module from Professional).
from Professional
Technical documentation
Art. 31, Annex VII
A cybersecurity section under Annex VII in the technical documentation checklist (from Starter), plus the CRA report as PDF and Word and its own chapter in the complete dossier (from Professional).
from Starter
EU declaration of conformity
Art. 28, Annex V
The CRA only appears in the declaration once classification and date are confirmed and the main obligations apply to the unit. Procedure and applied specifications have their own fields.
from Starter
Partly covered (8)
Part of it is in the software; you provide the rest.
Software bill of materials (SBOM)
Annex I Part II(1)
CE-Copilot stores the SBOM file, for example in CycloneDX or SPDX format, in the project and records whether and how users get access to it. You generate and analyse the SBOM with your development tools.
from Professional
Handling vulnerabilities
Annex I Part II(2) to (8)
For remediation, regular testing, disclosure of fixed vulnerabilities, the coordinated vulnerability disclosure policy, secure distribution and free security updates, you document implementation and evidence in the matrix. You write and publish the security advisories and the disclosure policy yourself.
from Professional
Single point of contact for vulnerabilities
Art. 13(17)
You enter the point of contact in the vulnerabilities section of the project page; it appears in the CRA report and in the user information. You run the mailbox or reporting portal yourself.
from Professional
Informing users about incidents
Art. 14(8)
Each case has a template for the user information and records when users were informed as evidence. You send the information to your customers.
from Professional
Substantial modification
Art. 3(30), Art. 22
In the app, the date of a substantial modification triggers the obligations under the Regulation. Whether a software update or a rebuild is substantial is your assessment.
from Starter
Software versions and product series
Art. 13(8) and (10)
Support period, assessment and reporting cases are kept per project. Several delivered software versions, or one vulnerability affecting several product series, are managed through the individual projects.
Copy or simplified declaration of conformity
Art. 13(20), Annex VI
The app produces the full declaration as PDF and Word to accompany the product. A simplified declaration under Annex VI with the internet address you draft yourself.
from Starter
Keeping documents for ten years
Art. 13(13)
Projects with reported cases are locked against deletion, and you export the report and dossier as PDF and Word. Keeping them for ten years is organised in your own archive.
Stays with the manufacturer (5)
No dedicated function in CE-Copilot; you meet the obligation outside the software.
Secure development and security testing
Annex I Part I(2)
Technical implementation, penetration tests and code reviews happen in your development. CE-Copilot documents which measure meets which requirement.
Reporting on ENISA's platform
Art. 14, Art. 16
You submit the notification through ENISA's Single Reporting Platform. CE-Copilot is not connected to the platform; deadlines, templates and evidence come from the app.
Assessment by a notified body
Art. 32(2) to (4)
Where the procedure requires a notified body, you engage it. The report and technical documentation from CE-Copilot serve as input.
Corrective action, recall and information to authorities
Art. 13(21) to (23)
Corrective action, withdrawal from the market, cooperation with market surveillance and notice when ceasing operations remain with the manufacturer.
Obligations of importers and distributors
Art. 19, Art. 20
CE-Copilot is built for manufacturers. The verification duties of importers and distributors are not modelled separately.
Next to the CRA: the same interface inventory feeds the assessment of protection against corruption under Annex III, sections 1.1.9 and 1.2.1 of the Machinery Regulation and the EN 18031 checklist for radio equipment, with the restrictions of Implementing Decision (EU) 2025/138. More in the guide Cybersecurity for machinery.
How to recognise good CRA software
Seven questions to ask any CRA software, and how CE-Copilot answers them:
1. Does the software derive the key dates from the date of placing on the market?
Whether a machine is subject only to the reporting obligations or to the whole Regulation depends on that date and on later substantial modifications (Articles 69 and 71).
In CE-Copilot: Yes. A date that was only read from the description has no legal effect until you confirm it.
2. Does it know the reporting deadlines in hours and in calendar days?
Early warning and notification run in hours from awareness, the final report in days or one month; in an emergency the evidence has to be in place.
In CE-Copilot: Yes. Deadlines per case with a status light, text templates and an evidence trail that can no longer be deleted once reported.
3. Does it document Annex I requirement by requirement?
Article 13(4) requires a justification for every requirement that does not apply; Annex VII requires a description of how each is implemented.
In CE-Copilot: Yes. A matrix with wording, applicability, justification, implementation and evidence.
4. Does it connect the CRA with the Machinery Regulation and the Radio Equipment Directive?
For machinery, protection against corruption (Annex III, sections 1.1.9 and 1.2.1 of the Machinery Regulation), the cybersecurity of radio equipment and the CRA run side by side.
In CE-Copilot: Yes. One interface inventory for all three assessments, in the same file as the risk assessment and the declaration of conformity.
5. Does it produce documents that fit the CE file?
Technical documentation, declaration of conformity and operating instructions have to say the same thing.
In CE-Copilot: Yes. CRA report, dossier chapter, technical documentation section, declaration and operating instructions chapter from the same data.
6. Does it separate internal evidence from documents for customers?
Open vulnerabilities do not belong in a document that goes to customers or bodies.
In CE-Copilot: Yes. The dossier chapter shows no reporting cases; the full report carries a confidentiality notice.
7. Do legal consequences stay fixed rules rather than AI decisions?
Key dates, procedures and deadlines have to be traceable.
In CE-Copilot: Yes. These rules are fixed logic; AI drafts for texts are only used once you confirm them.
Who CE-Copilot suits as CRA software
- Machine builders and special-purpose machine builders whose machines exchange data via fieldbus, Ethernet, remote maintenance, cloud or radio.
- Plant builders and integrators who place interlinked installations on the market as manufacturer and assess the cybersecurity of the whole.
- Manufacturers delivering before 11 December 2027: the reporting obligations apply to them today, and the other sections prepare later units.
- CE-Copilot is not meant as a software development tool: SBOM generators, vulnerability scanners and update servers remain separate tools.
Legal status
The reporting obligations under Article 14 have applied since 11 September 2026, including to machines with a data connection that are already on the market (Article 69(3)). The remaining obligations apply to products placed on the market from 11 December 2027 (Article 71(2)). As of the legal status of this guide, no harmonised standard under the CRA has been published in the Official Journal, so there is no presumption of conformity through harmonised standards under Article 27 yet. You record applied specifications such as IEC 62443 as such in CE-Copilot. How the app works by date of placing on the market is shown in the guide Cyber Resilience Act software for machinery; plans are listed on the pricing page.
FAQ
Frequently asked questions
What software do I need to comply with the CRA?
Does CE-Copilot cover every obligation of the Cyber Resilience Act?
Does CE-Copilot itself fall under the CRA?
Is there a CRA checklist in CE-Copilot?
Which products is CE-Copilot suitable for as CRA software?
Which plan includes the CRA functions?
Does CE-Copilot replace a notified body or legal advice?
Run EU machinery compliance in-house, in English
This guide is written by the team behind CE-Copilot, a software platform covering the whole EU CE process for machinery: directive classification, a standards finder across 3,600+ standards with harmonisation status, risk assessment per EN ISO 12100, functional safety documentation, test reports, the technical file, operating instructions and the EU Declaration of Conformity. Documents are exported in English or German, the EU Declaration of Conformity additionally in French and Italian. The platform is available in English; the AI drafts, you review and sign off.
More English guides
This guide is general information for machinery manufacturers, verified against the official EU legal texts as of 30 October 2026. It is not legal advice. For decisions about your specific product, consult the legal texts (EUR-Lex) or a qualified advisor.