For manufacturers of devices and software
The CRA and your products' vulnerabilities: we watch them for you. You only make the decisions.
The CRA (Cyber Resilience Act) is the EU law on the security of products with software. A vulnerability is a hole through which such a product can be attacked. When criminals already exploit it, the manufacturer must report it within 24 hours; this duty has applied since 11 September 2026. We do the technical part for you.
Does it apply to my company?
Yes, if you sell something in the European Union that runs software:
- a device with software, e.g. a thermostat, till, controller, camera, gateway, lock
- software installed at customers or an app for your device
- also products already on sale, not only new ones
Small companies are not exempt. The law does not cover, among others, medical devices, cars and services that run only in the cloud (SaaS): other rules apply to them. Not sure? Ask on the call, I’ll answer in 5 minutes.
What has changed and what is at stake
- 11 September 2026Already in force: reporting holes that criminals already exploit. The first warning within 24 hours.
- 11 December 2027Full CRA requirements. Without them the product won’t get the CE mark and can’t be sold in the EU.
- up to EUR 15 millionor 2.5% of annual turnover: the possible fines for failing the obligations.
How it works, in plain words
- We list what your product is made of
Every device runs ready-made software from other companies, e.g. for encryption or connectivity. We list it, like the ingredients on a yoghurt label. The technical term is SBOM. I do it with your developer or supplier; you don’t need the details.
- Every day we check whether someone has found a hole in them
A security hole (vulnerability) is a flaw through which an attacker may, for example, take over the device or steal data. More than a hundred are published every day. Meldora compares your list with public databases of holes and tells you as soon as something matches.
- We assess whether it really threatens your product
Often the vulnerable part doesn’t even run in your device, and then there is no problem. If it does, you get a rating of how dangerous the hole is and advice on what to do.
- We tell you whether to report it and prepare the report
You get a clear answer: report or not, and why. If you must, you get ready texts to paste and deadline reminders.
How dangerous is the hole?
Every hole gets a score from 0 to 10 (the international CVSS scale). It decides how quickly it has to be fixed.
Do you have to report it? Where and how?
The score alone doesn’t decide. You report when attackers are already using the hole in your product (the legal term: actively exploited). Then three deadlines count:
- Where: on the reporting platform of ENISA (the EU cybersecurity agency). The report also reaches the team in your country (the national CSIRT).
- Who sends it: You, as the manufacturer. We prepare the texts in English; you sign in and paste them.
- When nobody exploits the hole: you don’t report; you fix it in an update. You get a report that documents it.
- Severe incident: you also report an attack that compromised the security of your product, e.g. customers' devices taken over: also within 24 and 72 hours, with the final report within a month.
Who does what
- your products’ component lists
- a daily check of vulnerability databases
- assessing whether a hole affects the product
- the report and ready-made notification texts
- deadline reminders, a phone call in urgent cases
- answer questions about the product (or pass them to your developer)
- decide what to send for assessment
- send the ready report and inform your customers
You won't miss the 24 hours. When something urgent affects your product, you get an e-mail, I call your contact person, and the portal counts down.
A product security specialist is a full-time post. Here you pay a fixed monthly fee and for the expert assessments you order.
Every decision has a date, an author and a reason. When a customer, auditor or authority asks about the CRA, you show the reports and the log.
How we work together
- A 30-minute call. I check whether and how the CRA applies to your products. No commitment.
- Contract and set-up, usually 1–2 weeks. We list your products’ components and set up your portal account.
- Daily monitoring. We only get in touch when something needs doing.
- Reports and notifications. You get a decision and ready-made texts when a hole affects the product.
What it costs
- Implementation
- from 4,900 zł net
- One-off, for the first product: we list its ingredients, set up your portal account and show you how to use it. Every further product costs less.
- Ongoing care
- from 390 zł net per month
- The portal, daily checks of vulnerability databases and alerts. The higher packages include expert assessments.
- Expert assessment and preparing the ENISA notification
- only when needed
- Charged separately or included in a higher package. You send the notification; we prepare the texts for all three stages and watch the deadlines. You see the price in the portal before you order anything.
One product and the With an expert package, which includes 3 expert assessments a month: onboarding 4,900 zł and 790 zł a month. About 14,400 zł net in the first year and about 9,500 zł in each following year.
An extra assessment above the package: 190 zł per item. Preparing an ENISA notification: 2,900 zł, only when one is needed. The lowest package, with no assessments included: 390 zł a month.
You get an exact quote for your products in writing after the free call. You sign nothing until you know the whole amount.
Free and without obligation: 30 minutes is enough to know what applies to you and where to start. You can also write: kontakt@meldora.pl.