Compare Vulnerability Reporting Providers for Cyber Resilience Act (CRA)

• CRA vulnerability reporting is mandatory from September 11, 2026
• Only some providers publish prices and included details
• Representation covers report transmission, not technical assessment
• Compare exclusions, renewals, and verification processes
• Fines for failure to report can reach €15 million or 2.5% of turnover
• Representative mandate does not cover assessment, SBOM, or technical support

Updated 21 October 2026 · 12 sources checked

Providers compared

Prices as published on each provider's website on 21 October 2026, excluding VAT unless stated. Each row links to its source.

Legal Requirements: Obligations, Articles, and Deadlines

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, introduces strict obligations for those placing products with digital elements—both hardware and software—on the EU market, regardless of their establishment location. The main obligations are:

• Appointment of an authorized representative (Art. 18): If the manufacturer is not established in the EU, they must designate a representative in the Union in writing. This representative is responsible for transmitting vulnerability and serious incident reports to competent authorities (CSIRT, ENISA).
• Vulnerability reporting (Art. 14): From September 11, 2026, every manufacturer must report within 24 hours of becoming aware of an actively exploited vulnerability or a serious incident impacting product security. Reports must be submitted via the ENISA platform and addressed to the coordinating CSIRT.
• Complete notification and final report: Within 72 hours of the initial report, a detailed notification with initial corrective measures must be provided. Within 14-30 days, a final report detailing the vulnerability and the solution adopted must be sent.
• Applies to all digital products: The obligation covers both new and existing products on the market, including their entire lifecycle, updates, and support.
• Sanctions: Non-compliance can lead to fines up to €15 million or 2.5% of global turnover, whichever is higher.

It is essential to distinguish CRA reporting (product vulnerabilities) from other obligations such as GDPR (personal data breaches) or NIS2 (service incidents). Each regime has different recipients, deadlines, and platforms.

How to Choose a Provider: Practical Criteria and Risks

Choosing a provider for CRA vulnerability reporting should be guided by practical and transparent criteria. Key points to evaluate include:

• Published and transparent price: Prefer providers who clearly state the price and renewal cost. Avoid offers with "introductory" prices or hidden renewals.
• What is included: Check if the service covers only the representative mandate and report forwarding, or if it also offers technical support, documentation, SBOM, or advanced workflows. Most providers limit themselves to legal representation.
• Verifiable certificate: A certificate with a QR code and public verification page reduces the risk of disputes during audits or incidents.
• 24/7 active desk: Reporting must be possible at any time, including nights, weekends, and holidays. Explicitly ask if the desk operates year-round.
• Language and response times: Ensure the provider can handle requests in English and, if necessary, other EU languages. Forwarding times longer than 24 hours can jeopardize compliance.
• Exclusions and limits: No representative covers technical assessment, security testing, SBOM generation, or engineering support: these remain the responsibility of the manufacturer or specialized providers.

Always assess the clarity of exclusions: a provider that does not specify them risks not having clearly defined the service scope.

What the Price Really Includes: Comparison Table and Analysis

Most providers offer the representative mandate and forwarding of reports, but few cover additional technical services. Here is a comparison table:

The main difference between "classic" providers (REP27, kadano, Euverify) and those offering broader services (Attestra AI, Seentrix, Illicium) is that the former limit themselves to the minimum legal obligations, while the latter also provide security workflows, automated SBOMs, or pentesting. However, for compliance with Art. 18 and 14 CRA alone, the representative mandate and timely forwarding of reports are sufficient.

Note: the published price covers only what is explicitly declared. Additional technical services are often quoted separately and can be much more expensive.

Hidden Costs, Exclusions, and What Providers Don’t Say

Many providers do not publish renewal prices or apply extra fees for out-of-hours requests, issuing additional certificates, or support in languages other than English. Here is what to keep in mind:

• Renewals: Always ask for the written renewal price before signing. REP27 clearly publishes it (€440), others communicate it only on request.
• Exclusions: No provider covers compliance assessment, security testing, SBOM generation, or engineering support. These services are separate and often much more expensive than the representative mandate.
• Liability limits: Providers do not assume responsibility for technical errors, failure to report by the client, or vulnerability management itself.
• Notice period: Some providers may require notice for service termination or representative change. Always verify contract conditions.
• Per-request fees: In absence of public information, ask if costs apply for extra requests, issuing new certificates, or emergency support.

Decision table:

In summary, clarity on exclusions and hidden costs is essential to avoid surprises and ensure full compliance.

How Appointment Works: Step-by-Step and Practical Checklist

Appointing a CRA representative follows key steps. Here is a detailed guide:

1. Verify obligation: Are you a manufacturer of digital products (hardware/software) sold in the EU without an establishment in the Union? If yes, you are subject to the obligation.
2. Choose the provider: Compare prices, inclusions, exclusions, and verification processes. Prefer providers with 24/7 desk and publicly verifiable certificate.
3. Sign the mandate: The mandate must be written, signed by the provider’s legal entity (e.g., Europe Services, SE for REP27), and limited to Art. 18 obligations. Avoid mandates claiming to cover Art. 13 as well.
4. Receive the certificate: The provider issues an appointment certificate, preferably with QR code and online verification page.
5. Prepare internal runbook: Include representative data, escalation procedures, and reporting contacts in internal documentation.
6. Set up reporting channel: Prepare an internal channel to collect vulnerability and incident reports, with at least two persons appointed as submitters on the ENISA platform.
7. Train the team: Ensure staff know what and when to report, and that procedures are tested in simulations.

Practical checklist:

1. Have you identified product classes and their EU destination?
2. Have you mapped all sales and distribution channels?
3. Have you chosen a provider with 24/7 desk and transparent renewal price?
4. Have you written escalation and reporting procedures?
5. Have you appointed at least two submitters on the ENISA platform?
6. Have you tested the reporting flow with a simulation?

Following these steps minimizes the risk of non-compliance and penalties.

Risks, Fines, and Real Scenarios: What Can Happen in Practice

Failure to report a vulnerability within 24 hours can lead to fines up to €15 million or 2.5% of global turnover, as well as reputational damage and sales blocking in the EU. Here are three realistic scenarios illustrating how obligations apply:

• US SaaS: A US SaaS company offering services to EU customers must appoint a CRA representative, activate a 24/7 reporting channel, and report every exploited vulnerability. The representative provider forwards reports via ENISA and responds to authority requests.
• Chinese Amazon seller: If the seller is also the manufacturer of the digital product, they must appoint a CRA representative and meet reporting deadlines. If only a reseller, the obligation falls on the manufacturer. The reporting channel must be ready by September 11, 2026.
• UK online shop: A UK online store selling devices with firmware to EU customers must appoint a CRA representative. If offering only non-digital services, it is not subject to the obligation. In case of an incident, reporting must occur within 24 hours, even if the establishment is outside the EU.

In all cases, lack of preparation (absence of runbook, untested reporting channel, unverifiable representative) can slow response and worsen legal and financial consequences.