# Meet the Cyber Resilience Act without a security team. Kernwatch keeps your SBOMs current, checks your components for new vulnerabilities (daily on paid plans, weekly on Free) and walks you through the 24-hour, 72-hour and final CRA reports - so a small engineering team can stay compliant. Source: https://kernwatch.com/ · Last updated: 2026-10-18 ## The deadlines are already running - **11 Sep 2026** - Reporting obligations apply: Actively exploited vulnerabilities and severe incidents must be reported via the ENISA single reporting platform. - **11 Dec 2027** - All CRA requirements apply: Products with digital elements need CRA conformity and CE marking to be placed on the EU market. - **Up to €15M** - or 2.5 % of worldwide turnover: Maximum fines for breaching the essential cybersecurity requirements and manufacturer obligations. ## Cyber Resilience Act and SBOM: short answers ### What is the Cyber Resilience Act, and who does it apply to? The Cyber Resilience Act (CRA) is Regulation (EU) 2024/2847, the EU law on cybersecurity requirements for products with digital elements. It applies to hardware with software and to software products placed on the EU market, and its obligations fall mainly on their manufacturers, whatever their size. Sectors with their own rules, such as medical devices, motor vehicles and civil aviation, are excluded, and pure software-as-a-service without a product is generally outside it. The regulation entered into force on 10 December 2024. [CRA reporting obligations in detail](https://kernwatch.com/cra-reporting) Source: [Regulation (EU) 2024/2847, EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/2847/oj), [Cyber Resilience Act, European Commission](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act) ### What is the CRA reporting obligation? Since 11 September 2026, manufacturers must report every actively exploited vulnerability in their product and every severe incident affecting its security - also for products already on the market. An early warning is due within 24 hours of becoming aware, a notification within 72 hours, and a final report at the latest 14 days after a fix is available (vulnerabilities) or within one month of the notification (incidents). Reports go through ENISA's single reporting platform to the coordinating CSIRT and to ENISA; the platform has no API for manufacturers, so each report is submitted by hand in the browser. [CRA reporting: triggers, deadlines, recipients](https://kernwatch.com/cra-reporting) · [The CRA reporting workflow](https://kernwatch.com/tutorials#cra-reporting) Source: [Regulation (EU) 2024/2847, Article 14, EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/2847/oj), [ENISA](https://www.enisa.europa.eu/) ### How do you create an SBOM? Generate it automatically in your build pipeline instead of writing it by hand. Use one of the two widely used machine-readable formats, CycloneDX or SPDX, and create one SBOM per released version. Generators exist for most ecosystems, for example Syft or cdxgen for containers and file systems, the CycloneDX plugins for Maven, Gradle and npm, and the SPDX output of the Yocto Project for embedded Linux. 1. **Choose the format.** CycloneDX or SPDX - both are machine-readable. 2. **Generate it in CI.** Run the SBOM generator for your ecosystem on every release build. 3. **Keep one SBOM per release.** Store it with the release as part of the technical documentation. 4. **Check it against vulnerability data.** Kernwatch checks components with a package identifier (purl) daily on paid plans, weekly on Free. [SBOM for the CRA](https://kernwatch.com/sbom) · [Products, releases and SBOMs](https://kernwatch.com/tutorials#products-and-sboms) · [Upload SBOMs from CI with an API key](https://kernwatch.com/tutorials#ci-upload-api-keys) Source: [CycloneDX specification](https://cyclonedx.org/), [SPDX specification](https://spdx.dev/) ### When does the CRA make an SBOM mandatory? The SBOM belongs to the CRA requirements that apply from 11 December 2027: from then on, products with digital elements need CRA conformity and CE marking to be placed on the EU market. Annex I requires an SBOM in a commonly used, machine-readable format covering at least the top-level dependencies. It is part of the technical documentation - it need not be published, but market surveillance authorities can request it. Since reporting started on 11 September 2026, a current SBOM is also the quickest way to tell whether an exploited vulnerability affects your products. [What the CRA requires of an SBOM](https://kernwatch.com/sbom) Source: [Regulation (EU) 2024/2847, Annex I, EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) ### What does a CRA vulnerability reporting tool do? It turns monitoring results and deadlines into tasks. In Kernwatch, a finding on a list of actively exploited vulnerabilities becomes an action-inbox task to open a reporting case due 24 hours after you became aware, and the early warning, notification and final report are drafted from your product, release and triage data for your sign-off. You submit on ENISA's platform yourself and record the reference; when a newer release no longer contains the vulnerable version, Kernwatch proposes the fix date that starts the 14-day final-report clock. Tasks appear on every plan; approving reporting cases and reports needs Starter or above. [Plans and prices](https://kernwatch.com/pricing) · [The action inbox](https://kernwatch.com/tutorials#action-inbox) ## How Kernwatch works 1. **Register products and releases** - Every version you ship, with its support period - the CRA expects security updates for at least five years in most cases. 2. **Upload SBOMs** - CycloneDX or SPDX, uploaded by hand or pushed from your CI pipeline on every release. 3. **Get alerted** - Every component with a package identifier (purl) is checked against OSV, the CISA Known Exploited Vulnerabilities list and the EU vulnerability database: daily on paid plans, weekly on Free. 4. **Triage and report** - Record each decision (VEX). When you must notify, Kernwatch starts the clock, prefills the reports and collects sign-off and evidence. ## Your CRA to-do list fills itself Kernwatch turns monitoring results, reporting deadlines and new releases into an action inbox. Every task comes with a prepared suggestion and the reason for it: you review it and approve it with one click. Nothing reaches an authority or your users without your approval. - **Triage suggestions with reasons** - New findings arrive with a suggested decision and why: not affected when the SBOM says the component is not shipped (approve these in bulk), affected when it is actively exploited or a fixed version is known, otherwise under investigation. - **A reporting case when exploitation is known** - A finding on a list of actively exploited vulnerabilities becomes a task to open a CRA reporting case, due 24 hours after you became aware. - **Reports prepared for your sign-off** - The early warning, the notification and the final report are drafted from your data. You review them, edit if needed and sign off before the deadline. - **ENISA filing aid** - After sign-off, copy the text, open the ENISA reporting platform, submit it there and record the reference you get back in Kernwatch. - **Fix detection starts the final-report clock** - When a newer release's SBOM no longer contains the vulnerable version, Kernwatch proposes that release date as the corrective measure. Approving it starts the 14-day clock for the final report. - **Users informed after your approval** - One approval emails the notice to the product's customer contacts and logs it. On Professional it also publishes your prepared security advisory. - **Housekeeping reminders** - Releases without an SBOM and support periods that end within 30 days - on Professional also a declaration of conformity older than your newest release. - **A daily digest** - Every member gets one email a day with the tasks that wait for them. Kernwatch cannot submit reports for you: ENISA's single reporting platform has no API for manufacturers. Kernwatch prepares everything up to the submit button - you submit in your browser and record the reference. Tasks appear on every plan; approving triage, reporting cases, reports and user notices needs Starter or above. Published advisories and reports from your public vulnerability page are part of Professional. ## Everything the CRA asks of your vulnerability handling - **Product and release register** - Products, versions and support periods - the backbone of your CRA documentation. - **SBOM management** - Import CycloneDX and SPDX, compare releases, see top-level and transitive dependencies and export on request. - **Vulnerability monitoring** - New advisories matched to your components with a package identifier (purl) - daily on paid plans, weekly on Free - with severity, exploit likelihood and a known-exploited flag. - **VEX triage** - Affected, not affected (with justification) or fixed in version - decisions that hold up when an authority or customer asks. - **CRA reporting workflow** - 24 h early warning, 72 h notification and final report with reminders, prefilled texts, approvals and filing evidence. - **Disclosure and documentation** - A vulnerability reporting channel, security.txt, published advisories and your technical documentation in one place. - **Action inbox** - Tasks that create themselves: triage suggestions with reasons, reports prepared for sign-off, ENISA filing aid, fix detection and user notices - each approved with one click. ## Why not just a free scanner? Open-source scanners find vulnerabilities - and you should use them. The CRA asks for more: a documented decision for every finding, reports within hours, information for your users and documentation that is kept for years. Kernwatch is that workflow, ready on day one, without building and running your own tooling. ## Built for small and mid-sized manufacturers Teams of 20 to 250 people who ship products with software into the EU and have no dedicated product security team: - Machinery and automation - Electronics and IoT devices - Industrial controllers and gateways - Embedded, desktop and installable software ## Frequently asked questions ### Does Kernwatch submit reports to ENISA for me? No. ENISA's single reporting platform has no API for manufacturers, so every report is submitted by you in the browser. Kernwatch prepares everything up to that point: it drafts the early warning, the notification and the final report, collects your sign-off, lets you copy the text and open the platform, and keeps the reference you record as evidence. ### When can we start? Create your account on the [sign-up page](/signup) - the free plan needs no credit card. If sign-up is paused, the same page puts you on the waitlist and we contact everyone in order. ### Where is our data stored? Kernwatch is hosted in the European Union. Each company's data is kept in its own workspace, separated from other customers by access checks on every query. ### Is Kernwatch legal advice? No. Kernwatch is software that organises your vulnerability handling and reporting. Your obligations depend on your products and should be confirmed with your advisor.