CRA-compliant,
with no blind spots.

Regulation (EU) 2024/2847 sets cybersecurity requirements for every product with digital elements placed on the European market: software, connected devices, embedded components. If your product connects to a network, directly or indirectly, it is very likely in scope. Read the regulation →

Two dates. On 11 September 2026, reporting actively exploited vulnerabilities becomes mandatory (Article 14). On 11 December 2027, the full set of requirements applies, including the sanctions regime: up to €15M or 2.5% of worldwide turnover (Article 64).

The Software Bill of Materials is the inventory of components — libraries, dependencies, versions — that make up your product. The CRA requires it in your technical documentation. Probenta generates it from your build pipeline, or takes an existing SBOM in the standard formats (CycloneDX, SPDX).

We continuously cross-check your SBOM against catalogues of actively exploited vulnerabilities, notably CISA's KEV catalog and CERT-FR advisories. Only a vulnerability that genuinely touches a component in your portfolio raises an alert. We orchestrate proven open-source tools rather than an opaque proprietary engine.

Article 14 sets three deadlines. Two run from the moment you become aware of the actively exploited vulnerability: an early warning within 24 h, then a detailed notification within 72 h. The third starts elsewhere: the final report is due within 14 days after a corrective or mitigating measure becomes available — and within one month of the notification where a severe incident is concerned. These go to the coordinating CSIRT and ENISA. ENISA provides no machine interface: filing remains a human action on its form. Probenta arms the clock as soon as you qualify the alert and pre-fills what can be pre-filled; the fields that carry a judgement remain yours, prepared in advance rather than discovered against the clock.

Every action is written to an append-only log: entries are time-stamped and chained to one another, so none can be altered or removed after the fact. That log is what you present to the supervisory authority to demonstrate the notification went out on time.

It is the documentation you must be able to produce at any time: product description, cybersecurity risk assessment, SBOM and components, vulnerability handling, support period. Probenta generates it from data you have already entered and keeps it current, rather than having you reconstruct a file the night before the audit.

Never. Probenta processes only your SBOM and product metadata. Your code stays with you. This is an architectural choice: the less sensitive data we hold, the smaller your attack surface — and ours.

In France, on Scaleway, a French cloud provider certified ISO 27001. Our e-mails go through Brevo (Sendinblue SAS), also a French company. No data leaves the European Union. The details are in our privacy policy.

Two levels. The first is financial: up to €15M or 2.5% of worldwide turnover for failing the essential requirements. The second is commercial, and often heavier: without compliant CE marking, the product can no longer be placed on the European market.