CRA demands evidence.
Your codebase already has it.
Concordance scans 50 engineering protocols across 6 SDLC phases and maps them to all 21 essential requirements of CRA Annex I. Paste any public GitHub, GitLab, or Bitbucket repo — see your evidence in seconds.
This is automated engineering evidence mapping only — not a conformity assessment, audit opinion, or attestation. It does not replace a full CRA compliance programme, legal counsel, or assessment by a notified body or market surveillance authority.
CRA conformity is determined through self-assessment (Annex III) or notified body evaluation — not by any tool. Concordance provides evidence signals as-is, with no warranty of completeness or accuracy. Regulation (EU) 2024/2847. See Methodology for full scope details.
How Concordance maps to CRA
The Concordance Framework observes 50 engineering protocols across 6 SDLC phases — branch protection, CI pipelines, review quality, dependency management, secrets handling, and more. Each protocol is scored 1–5 and mapped to CRA Annex I requirements, giving you continuous, automated evidence of the engineering practices that support conformity.
What is the Cyber Resilience Act?
The Cyber Resilience Act (Regulation (EU) 2024/2847) establishes cybersecurity requirements for products with digital elements sold in the EU. Annex I defines 21 essential requirements in two parts: 13 product security requirements (Part 1) and 8 vulnerability handling requirements (Part 2). Reporting obligations begin September 2026; main obligations apply from December 2027.
Most products can self-assess conformity under Annex III (per European Commission estimates). Important and Critical products require third-party assessment by a notified body. The Concordance Framework maps real engineering data to these requirements — providing the kind of structured, continuous evidence that supports conformity readiness. Stay audit-ready at all times.
The full CRA evidence report
21 requirements scored, technical documentation referenced, conformity-ready PDF exported — continuously, across every repo.