🇪🇺 Regulation (EU) 2024/2847
Starting from whether your product falls under Annex III/IV and which conformity assessment procedure applies, we build the risk assessment, technical documentation (Annex VII) and vulnerability handling process.
Book a free consultation →The EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) requires every "product with digital elements" to meet essential cybersecurity requirements before being placed on the EU market, and to keep handling vulnerabilities throughout its support period. It is not a one-off test but a long-term duty spanning design, market and end of life.
Sporton Cybersecurity Lab helps you determine your product's class (default / important Class I, II / critical), pick the right conformity assessment procedure, and build the risk assessment, technical documentation and vulnerability handling process — so you don't take the wrong route and redo it.
From 11 Dec 2027, non-compliant products with digital elements may not be made available on the EU market.
Getting classification and the assessment route wrong usually means redoing documentation and testing.
Obligations run through the whole support period — they don't end at CE.
Clarify the product type, target markets and applicable clauses, and define the tests and documents needed.
Map the product's current state to the standard's requirements and produce a gap analysis.
Run the test plan and process audit; add penetration testing and fuzzing where needed.
Consolidate results and evidence, map each item to a clause, and form an auditable record.
Deliver the report and improvement recommendations; for markets that require filing, help prepare the submission.
Tell us the product type and target markets and we will come back with the applicable clauses, test scope and timeline.