Cemply takes your connected product from zero to full CRA compliance — SBOM, vulnerability monitoring, ENISA reporting, CE technical file — and keeps it there for the life of the product. For the price of one consultant-day per month.
Free CRA-ready SBOM and vulnerability report, in minutes.
cemply.io/dashboard/products/gateway-x200
firmware 4.2.0 · important class I
Parts in this product
0
Needing a decision
01 being exploited
ENISA early warning drafted. 23 h 41 m left to submit.
Reporting obligations took effect in September 2026. Full compliance follows in December 2027.
days until ENISA reporting becomes mandatory
11 September 2026
days until full CRA compliance is required
11 December 2027
The four obligations
Know what's inside every product.
Connect your repository or paste your lockfile. Cemply reads the exact installed versions and the full transitive tree, then generates versioned CycloneDX/SPDX SBOMs for every product and every scan.
Never miss a vulnerability that matters.
Every night, Cemply re-checks your latest SBOM against public vulnerability databases and records every new match in your audit trail.
24h / 72h ENISA deadlines, handled.
Guided incident qualification, generated notifications and tamper-proof timestamps. Sleep through the night; keep the audit trail.
Your CE technical file, generated.
Annex VII documentation assembled from your real product data, versioned, and regenerated in one click whenever your product changes. You complete what only the manufacturer can know.
How it works
A repository URL or a pasted lockfile. Two minutes, no agent to install, no access to your source beyond the dependency file.
A CRA-ready SBOM in CycloneDX and SPDX, every component matched against OSV and cross-checked with the CISA exploited-vulnerability catalogue.
Nightly re-checks, ENISA deadlines tracked from the moment you become aware, and a technical file that regenerates as your product changes.
Deliverables
Not a dashboard screenshot. Machine-readable inventories, a structured Annex VII file, and an append-only audit trail that shows what was checked, when, and against which source.
What goes in a technical fileproduct-4.2.0.cdx.json
CycloneDX SBOM
product-4.2.0.spdx.json
SPDX SBOM
technical-file-v3.pdf
Annex VII file
audit-trail.csv
Evidence of monitoring
Paste your lockfile and get a CRA-ready SBOM plus a first look at the known vulnerabilities inside your product.
Generate your free SBOMPaid plans are opening shortly.
Leave your work email and we'll send you one message the day subscriptions open. No spam, no follow-ups.