Cyber Resilience Act Compliance: 9 Companies compared

Article 14 Ready is a preparation aid for manufacturers placing software or connected products on the EU market that must report under Article 14 of the Cyber Resilience Act. Its free field compiler runs in the browser, covers actively exploited vulnerabilities and severe incidents, and adapts the required fields to the 24h early warning, 72h notification and final report stages, with a reporting clock calculator. Incident entries stay in the browser and can be exported as Markdown, JSON or print/PDF. An optional 24h Dry Run, a self guided tabletop exercise delivered as a downloadable HTML file, costs EUR 79 excluding VAT as a one time purchase for business customers. The site states it is an independent aid and not an official filing channel, legal advice or a conformity assessment. It is operated by PEAK Consulting Services GmbH of Mannheim, Germany.

ConformOps is a cloud-hosted service that reads a software repository's manifests, lockfiles, CI configuration, SBOMs and security documentation, maps what it finds to the EU Cyber Resilience Act and returns an evidence package. Analysis is static; the site states that no code is executed and that detected secrets are redacted before storage. Input is via a read-only GitHub App, a ZIP upload or individual files, and outputs include a CycloneDX inventory, Annex-oriented working documents, traceability and register CSVs and an evidence workbook, with each finding classified as evidenced, partial, gap or not applicable. The site states that ConformOps does not certify products, issue declarations, replace a notified body or make legal conclusions. Pricing is published: a free preview for up to two products, a one-time Full Assessment at EUR 99 per product, Continuous monitoring at EUR 79 per month per product, and a Portfolio plan at EUR 249 per month for five products. The legal page states the service is operated by Simone Laudani in Italy; no company registration or VAT number is published.

DEKRA is the world's largest non-listed testing, inspection, and certification body, with a product-cybersecurity practice covering the full product lifecycle. It provides CRA readiness strategy, training, and turnkey projects, plus evaluation services mapped to harmonized and draft standards. DEKRA is an accredited ITSEF and Certification Body for the EUCC scheme and is set to become a CRA Notified Conformity Assessment Body, with notification beginning June 2026.

pi3g GmbH & Co. KG is a Leipzig-based firm with 16+ years building IoT devices, with a focus on embedded Linux. For pi3g the Cyber Resilience Act is an essential upcoming part of CE certification, and they help small and medium manufacturers of connected devices, firmware, and software components understand and meet its requirements. The service spans a fixed-price readiness assessment, hands-on engineering implementation support, and a full compliance package backed by legal-partner review and a single point of contact.

TUV SUD is a global testing, inspection, and certification organization with a dedicated CRA practice in its product-testing and cybersecurity divisions. It helps manufacturers interpret CRA obligations, run gap assessments, set up vulnerability management and incident reporting, and obtain third-party assessment for higher-risk products. It also runs RED cybersecurity testing against the EN 18031 series.