CRA

Get ready for the EU's Cyber Resilience Act

Keep your products cybersecure for CRA compliance with Codekeeper's verified escrow solutions.
Book a free demo
cra_hero_1x

Starting December 2027, Europe will no longer tolerate sloppy cybersecurity. If you can't guarantee your products will stay secure from first use to final shutdown, you won't be allowed to sell them.

The CRA: What you need to know

What is the Cyber Resilience Act?

The CRA is Europe's new cybersecurity law taking effect in December 2027. It covers devices with digital elements — smart watches, baby monitors, industrial equipment — and standalone software with connectivity capabilities — firmware, operating systems, video games. If you make or sell these products, you have to prove they can't be compromised throughout their entire lifespan to get CE marking and sell in Europe.

Who needs to comply with CRA?

The CRA affects anyone who touches connected hardware or software products heading to European customers:
monitor-smartphone
Device makers
building-2
Software companies
factory
Manufacturers
warehouse
Importers and distributors
store
Resellers

CRA key requirements

Europe's new cybersecurity law establishes six essential requirements that your products must meet:
1
Ship without known security vulnerabilities and include secure default settings with reset capabilities.
2
Support security updates throughout product life cycle to address newly discovered vulnerabilities.
3
Prevent unauthorized access through authentication and access control systems.
4
Protect data confidentiality and integrity by encrypting information and blocking unauthorized changes.
5
Maintain critical functions during incidents while minimizing impact on other systems.
6
Provide security monitoring and secure data removal with user notification and safe data transfer capabilities.

The software escrow — CRA connection

Software escrow directly addresses critical CRA requirements by ensuring vulnerabilities can be addressed, essential functions stay available, and products don't become network threats.
01
CRA risk
Your business faces disruption or failure
Customers lose access to essential product functions
You can't prove operational continuity for CE marking
Your products get banned from the EU market
02
Software escrow solution
Products keep working even when your business can't
Evidence for your CE mark requirements
Continuous ability to deliver updates
Protection from €15 million fines and market exclusion
03
Compliance outcome
AI operations stay documented even when vendors leave
Recoverable AI stack evidence ready for regulators
Article 11 documentation kept current and complete
Protection from fines for undocumented AI systems
With escrow, you have the backup to ensure your products won't become vulnerable no matter what happens. And that's exactly what Europe requires to let you sell there.

Let us help you be CRA compliant

Codekeeper combines comprehensive knowledge of EU regulatory requirements with advanced software protection expertise to deliver solutions specifically designed for manufacturers and developers managing CRA obligations.
We understand the complex challenges you're managing:
Everyone in your supply chain must take ownership of cybersecurity requirements.
The December 2027 deadline approaches while cyberattack costs escalate 15% annually.
Non-compliance brings €15 million fines and complete exclusion from the EU market.
You must redesign how you plan, build, distribute, and support your products under new regulations.
You need to meet tight security incident reports deadlines: early warning within 24 hours, fuller account within 72 hours, and a final report once it's fixed within 14 days.
We've secured critical software for thousands of manufacturers globally. We can keep your products available and resilient, too.
we_see_challenges_you_face

Codekeeper's complete solutions for CRA requirements

Our escrow solutions ensure your products continue operating throughout their complete life cycle, even when your business or suppliers can't support them — meeting the CRA's core availability and resilience requirements.
Software Escrow

Protection scope: Traditional software and firmware

Stores your on-premises software's source code safely so customers can keep products working if your business faces problems.
Guarantees products can remain accessible for their full operational period
Maintains essential functions during business disruptions
Prevents products from failing and affecting connected systems
Provides documented recovery capabilities for CE marking
Learn more
how_it_works_software_escrow_3x
SAAS escrow

Protection scope: Cloud-based components

Protects cloud services your products depend on by storing everything needed to keep them running if cloud providers disappear or fail.
Ensures cloud-dependent products maintain essential functions
Eliminates service outages from cascading to other systems
Sustains product availability regardless of vendor problems
Covers modern architectures that rely on cloud services
Learn more
how_it_works_saas_escrow_3x
continuity escrow

Protection scope: Supporting infrastructure and services

Takes over payments for critical supporting services when vendor relationships break.
Preserves essential functions by keeping supporting services running
Keeps infrastructure failures from affecting product availability
Delivers continuous operation during vendor payment disputes or failures
Supports complex dependencies that products rely on to function
Learn more
continuity_escrow_1x
Verification

Protection scope: All escrowed materials

Tests all stored code and configurations to ensure they're complete and functional.
Validates that deposited materials actually work for keeping products operational
Identifies any missing components before you need them
Generates compliance documentation for regulatory audits
Creates Software Resilience Certificates proving recovery capabilities
Learn more
how_it_works_continuity_escrow_3x-1

Get CRA compliant in 4 simple steps

The CRA requires you to prove your products won't abandon customers when your business faces problems. Here's how to demonstrate that capability:
1

Book your CRA assessment call

We'll review your portfolio, then recommend the optimal escrow strategy for your specific CRA requirements.

2

Select your escrow solutions and verification level

Choose from Software Escrow, SaaS Escrow, and Continuity Escrow based on your product architecture.

3

We implement everything for you

Our team coordinates with your vendors, drafts all legal agreements, and facilitates automated deposit setups.

4

Get your compliance documentation

Order verification to receive Software Resilience Certificates proving your recovery capabilities — all ready for audits.

One call. One solution. Complete availability and resilience protection for CRA compliance.
Book a free demo

Codekeeper takes the complexity out of compliance

Over the years, we've helped thousands of manufacturers protect their critical software without drowning in regulatory complexity. Our solutions make CRA requirements straightforward and manageable.
Airbus
Bayer
European parliament
General Motors
Intuit
Nestle
Pepsico
Pfizer

CRA D-day: It's time to plan for compliance

LogIn

December 10, 2024

CRA enters into force across all EU member states
FileBarChart

September 11, 2026

Reporting obligations apply for cybersecurity incidents
FileCheck2-1

December 11, 2027

Main CRA obligations take effect for all manufacturers
FileBadge2-1

Ongoing from 2027

Continuous conformity assessments and CE marking requirements

The cost of missing CRA deadlines

Non-compliance with the CRA creates cascading business risks that threaten your entire European operation:
Complete EU market lockout
Products that can't prove lifetime security guarantees get banned from sale across all 27 member states.
Crushing financial penalties
You face fines reaching €15 million or 2.5% of worldwide revenue — whichever damages your business more.
Brand damage
Product recalls and compliance failures become public record, undermining customer trust and partner relationships.
Competitive setback
Competitors with solid compliance strategies capture your market share while you fight to regain market access.
Europe won't negotiate on cybersecurity. Secure your market access before the deadline.
E-BOOK

The CRA: Your Complete Compliance Guide

Fill in the form below to get expert guidance on meeting Europe's cybersecurity requirements for connected products.
cra
*E-book available only in English
Get your free CRA compliance guide

How you benefit from CRA compliance

Secure your European market access

Meet Europe's December 2027 requirements to avoid complete market exclusion and fines up to €15 million. CRA compliance keeps your products eligible for sale across all 27 EU member states in a market worth €3 trillion annually.

Turn compliance into competitive advantage

Demonstrate operational resilience that competitors can't match. CRA compliance proves you can support products throughout their lifespan, winning deals against rivals who can't make those guarantees.

Protect your business from disruption risks

Ensure you can maintain product support and avoid costly recalls even during business problems. CRA compliance planning creates recovery capabilities that protect your revenue streams and market position.

Build investor and partner confidence

Provide leadership teams and business partners with concrete evidence of continuity planning. CRA compliance shows you've built a resilient business model instead of leaving everything to chance.
cps_cta_1x

Secure your products ahead of the CRA deadline

Our compliance specialists can show you precisely how our escrow solutions address CRA requirements while protecting your business from operational disruption.
Personalized analysis of your compliance requirements
Clear overview of how escrow meets CRA continuity obligations
Easy-to-understand guidance without industry complexity
Practical implementation steps you can begin today
Book a free demo
Frequently asked questions

Good questions to ask first.

What is the Cyber Resilience Act? 

The CRA is Europe's cybersecurity law starting December 2027. It covers connected products and software sold in Europe. If you make these products, you must prove they won't abandon customers during their lifetime to get CE marking and market access.

Why is software escrow important for CRA compliance? 

Software escrow aligns with CRA requirements for vulnerability handling and product support. It ensures customers have access to critical source code to maintain products and fix problems when your business can no longer provide support — exactly what Europe requires for CE marking.

Can Codekeeper help with CRA compliance? 

Yes. We help device manufacturers and software developers meet CRA requirements by ensuring products stay available and resilient. Our platform stores your software and verifies it works for recovery, handles the legal paperwork, and provides certificates proving your compliance readiness.

What happens if I don't comply with the CRA? 

You face fines up to €15 million or 2.5% of global revenue. Additionally, products without CE marking can't be sold in Europe, and regulators can force recalls or market bans. 

How does the CRA affect different types of organizations? 

The CRA impacts organizations differently based on their role in the supply chain. Device manufacturers face the most extensive requirements since they're responsible for proving operational resilience. Software companies also need to comply, but only when they develop commercial connected products. Meanwhile, importers, distributors, and resellers have their own specific obligations, though they risk being classified as "manufacturers" and facing even stricter requirements.

When do I need to start preparing for CRA compliance? 

You should start preparing immediately, even though the main rules don't apply until December 2027. The CE marking process requires significant lead time, and some reporting requirements may begin earlier than the main deadline. Since Europe is still developing the detailed implementation standards, you'll need ample time to understand the requirements, implement necessary changes, and compile all the required documentation. 

More answers in the FAQ →

Let's build bulletproof software resilience together.

Book a demo