CSOAI
Initializing...
Free forever · No credit card
CSOAI
Initializing...
CRA compliance kit — £999 one-time + £199/mo monitoring (optional)
AI products with digital elements must be secure-by-design, vulnerability-managed, and CE-marked to enter the EU market. We map every CRA essential requirement to controls, evidence, and a signed attestation.
CRA timeline and penalties
CRA Quick Scope
£9one-time
Product classification questionnaire and essential-requirements gap summary.
Get £9 Quick ScopeCRA Compliance Kit
£999one-time
Classification guide, security-by-design templates, vulnerability handling policy, technical documentation pack, and one attestation.
Buy — £999Audit-Prep Bundle
£4,950one-time
Kit + 2-day engagement + CE technical file review + 90-day support.
Buy Audit-Prep — £4,950Enterprise
£1,499/month
Continuous vulnerability monitoring, SBOM refresh, incident reporting workflows, and unlimited attestations.
Talk sales — £1,499/moProduct classification & CE pathway
Classify your software or AI product under CRA risk tiers, determine applicable essential requirements, and build the technical documentation for CE marking.
Security-by-design & secure development
Threat modelling, secure coding practices, SBOM generation, SLSA provenance, and Sigstore signing aligned to CRA Annex I.
Vulnerability handling & incident reporting
Coordinated vulnerability disclosure process, ENISA reporting timelines, and automated CVE/CISA KEV monitoring for dependencies.
Transparency & update obligations
Support lifecycle documentation, automatic update mechanisms, and user-facing security information required for products with digital elements.
Yes. The CRA applies to any product with digital elements placed on the EU market, including software, embedded systems, and AI-powered applications. AI products may also be subject to the EU AI Act; the two frameworks overlap on risk management, documentation, and security.
The CRA entered into force in December 2024. The first reporting and vulnerability-handling obligations apply from September 2026, with full CE-marking requirements from December 2027.
CRA classifies products into default (non-critical) and critical categories, with critical further split into Class I and Class II based on importance and cyber risk. Critical products require third-party conformity assessment; default products can self-assess.
Penalties can reach €15 million or 2.5% of global annual turnover for certain infringements, with higher penalties for critical-product violations. Market surveillance authorities can also prohibit or recall non-compliant products.
The CRA kit shares evidence with our EU AI Act and ISO 42001 kits: risk management, technical documentation, SBOM, vulnerability handling, and post-market monitoring. Customers using multiple kits get a unified evidence vault.
Also subject to the EU AI Act?
See the EU AI Act guide →MEOK AI Labs · CSOAI LTD · UK Companies House 16939677