From December 2027, digital products sold in the EU must comply with the CRA
Guidant AI ships with the EU Cyber Resilience Act framework built in — Annex I requirements, technical documentation and vulnerability handling in one place. We run our own product through it.
Screenshot: CRA Annex I requirements and assessment objectives
New to the CRA? Read the guide →
What the framework asks of you
01
Meet the Annex I security requirements
Secure by default, update mechanism, vulnerability handling, SBOM.
02
Prepare technical documentation and a declaration of conformity
Annex VII technical file, Annex V declaration.
03
Set up vulnerability handling
A reporting contact, security advisories, a support period of at least five years; from 11 September 2026, actively exploited vulnerabilities must be reported within 24 hours.
Read more: What is the CRA
How Guidant AI maps to it
| Framework requirement | Guidant AI |
|---|---|
| Annex I Part I (product security) | Built-in CRA framework, each requirement broken into objectives with suggested evidence |
| Annex I Part II (vulnerability handling) | Templates for vulnerability disclosure policy, security advisories, support period statement |
| SBOM | Third-party component risk module generates CycloneDX/SPDX and cross-checks known vulnerabilities |
| Annex VII technical documentation | SSP exports to Word with chapters mapped to Annex VII |
| Declaration of conformity | Annex V draft generated from project data |
| Ongoing maintenance | SBOM vulnerability check before every release; alerts on high-severity components |
Workflow
- Classify the product (default / important / critical)
- Inventory Annex I requirements
- Technical documentation
- Vulnerability handling process
- SBOM
- Declaration of conformity
- Maintain every release
Frequently asked questions
Yes. The CRA covers all "products with digital elements," including firmware and embedded software.
Related guides
Go to the compliance guides →