50 engineering protocols observed directly from your repos — mapped to all 21 Annex I essential requirements. Real data from your actual toolchain, not questionnaires. The CRA requires manufacturers of software products to demonstrate continuous cybersecurity compliance. For most products, you self-assess (per European Commission estimates). For critical products, notified bodies audit you. Concordance provides the technical documentation.
Run Free CRA Scan →Concordance observes 50 engineering protocols from your GitHub repos and issue trackers, then maps them to all 21 requirements of CRA Annex I. It reports what it finds — not whether you comply. Conformity decisions rest with your organisation. For most products, you self-assess under CRA (per European Commission estimates). For Important or Critical products, notified bodies conduct conformity assessment. Concordance provides the technical documentation evidence.
Requirements P1.7 (data minimisation) and P1.13 (secure disposal), P2.6 (ENISA reporting), and P2.7 (coordinated disclosure) are outside engineering signal scope. Requirements covering organisational policies, supplier assessment, and regulatory notification require evidence beyond what repositories provide.
The Cyber Resilience Act (CRA, Regulation EU 2024/2847) is the EU's mandatory security regulation for software products. All software sold or provided in the EU must meet 21 essential requirements, demonstrated through conformity assessment, by 11 December 2027.
Annex I defines 21 essential requirements across two parts: Part 1 covers 13 product property requirements (design, configuration, security updates, documentation). Part 2 covers 8 vulnerability handling requirements (identification, testing, remediation, disclosure, SBOMs).
Conformity Assessment: About 90% of software products self-assess their compliance. Products classified as Important or Critical must use a notified body for conformity assessment. Either way, you must produce technical documentation evidence showing how your product meets all 21 requirements.
Timeline: Reporting obligations begin 11 September 2026. Main obligations take effect 11 December 2027. Notified bodies are expected to be designated by mid-2026. Concordance provides continuous evidence mapping — engineering data from your toolchain, structured against Annex I requirements, ready when you need to demonstrate conformity.
Point Concordance at any public repo. See all 50 protocol scores mapped to Annex I requirements. Free, instant, no sign-up.
Read-only OAuth. Create your teams, add your repos. Portfolio view surfaces CRA-mapped evidence across every team in the org.
CRA requires ongoing compliance. Concordance scans continuously, so your evidence mapping stays current. Practices degrade? You see it before audit time.
When it's time to self-assess or submit to a notified body, the technical documentation is already structured. Per-team, per-requirement, mapped to Annex I, ready for submission.
Scan any public repo. See all 50 protocol scores mapped through the CRA lens. Understand what engineering data maps to Annex I on a single repo.
Up to 5 teams, 20 repos. Continuous observation. CRA evidence mapping across every team. Plus SOC 2, ISO 27001, Sentinel, and Bastion lenses.
Try a free sample scan on any public repo. When you're ready for org-wide evidence, the CRA Signal lens is included with Concordance Pro.