Questions and answers

No. The ENISA platform (SRP) has no API, and the manufacturer is responsible for the content. Meldora prepares the texts in the order of the form fields, tracks the deadlines and records the confirmations. You submit from your own SRP account.

No. The Article 14 obligation covers actively exploited vulnerabilities that affect your product, and severe incidents. Other vulnerabilities are fixed through normal handling, in updates. The consultant's report contains a clear decision on whether to report.

The reporting obligation (Article 14) applies from 11 September 2026. The remaining CRA requirements, including CE marking with cybersecurity, from 11 December 2027.

The SRP works in English, so the form texts are generated in English by default, while the report and the user notice are in the report's language. The consultant can prepare the texts in Polish if you agree so.

See the guide “How to generate an SBOM”. In most build systems one command (Syft, cdxgen) or one line of CI configuration is enough. The consultant helps with the set-up as part of the implementation service.

Yes. An SBOM shows what your product is made of, so it is stored in the EU, encrypted with your company's key and available only to your team and the consultant. We do not share it with other clients or third parties. Details are in the privacy policy.

Vulnerability databases grow every day. Meldora re-checks your components after every source refresh, so a vulnerability published today appears as a match even if you uploaded the SBOM long ago. That is what continuous monitoring means.

The portal shows the substitute contact and the period of absence. Monitoring and e-mail alerts work as usual, and in an urgent case the substitute calls. The contractual deadlines still apply.

Following ENISA's guidance: call the coordinator CSIRT designated for Poland (contact details are published by ENISA on the SRP page), note the time and content of the call in the order log, and complete the notification on the platform once it is back.

Meldora counts 72 hours from becoming aware, as Article 14 does. The SRP counter may count from the early-warning submission and show a different time. Follow the Regulation's deadline, which is the earlier one.

As many as you need. Each has their own account with MFA and own notification settings, and appears in the event log. Your team invites and removes people in the settings.

There are three parts. One-off implementation: from 4,900 zł net for the first product. A fixed monthly fee for the portal and monitoring: from 390 zł net. Expert assessments and the handling of ENISA notifications: paid only when they are needed; the higher packages include a few assessments a month. You get an exact quote for your products after the free call.

Example: one product with the With an expert package (3 expert assessments a month included) is 4,900 zł for onboarding and 790 zł a month, about 14,400 zł net in the first year. An extra assessment: 190 zł per item; preparing an ENISA notification: 2,900 zł, only when one is needed.

If you are already a client: your prices are in the contract and in the portal settings, and you see the cost of every order before you send it. The monitoring report is included in the monthly fee.

It does not require an ENISA notification, but it must be removed through vulnerability handling without undue delay. The consultant gives a recommendation and priority, and you plan the release with the fix.