Every SKU mapped to its manufacturer
We contact each manufacturer in English, Turkish or Chinese and handle every follow-up.
CRA evidence from every non-EU supplier, collected for you in 90 days
From 11 December 2027, EU importers must make sure each connected product they place on the market meets the Cyber Resilience Act. We contact your manufacturers in their own language and hand you an evidence file for every SKU.
Five importers per month. A 20-minute fit call comes first, and nothing is paid on this page.
- —days until the CRA applies to importers
- 1 fileof evidence for every SKU you sell
- 3 languagesfor requests: English, Turkish, Chinese
Evidence file
Portfolio · Germany
Complete SKUs1 of 3
| SKU | DoC | CE | Tech | Support | Vuln. |
|---|---|---|---|---|---|
| TH-2041Smart thermostat · TR | |||||
| GW-0310IP gateway · CN | |||||
| SP-1187Smart plug · CN |
Received
Requested
No answer
You already did this once for RED
When the RED cybersecurity requirements started in August 2025, someone on your team emailed suppliers, waited, sent reminders, and kept the answers in a spreadsheet. [NEED: verbatim interview quote]
The CRA asks importers for more, across every connected product. After a product ships, if you learn of a vulnerability, you have to tell the manufacturer.
With dozens of manufacturers in Asia and Türkiye, that is a lot of emails to answer before December 2027.
Before a connected product goes on sale, check that its manufacturer:
- completed the conformity assessment
- drew up the technical documentation
- applied the CE marking
- supplied the EU declaration of conformity and user information
Based on Article 19 of the Cyber Resilience Act. [NEED: legal review]
What you get from the pilot
You send one spreadsheet. We do the chasing.
An evidence file per SKU
EU declaration of conformity, CE marking check, support period end date, and the manufacturer's contact for vulnerability reports.
A gap list and one export
See which SKUs are missing what and who hasn't answered. Share one export when a customer or an authority asks.
How the 90-day pilot works
- Day 0
Send us an export of your connected SKUs and suppliers. A spreadsheet is fine.
- Week 1
We map each SKU to its manufacturer and agree the evidence checklist with you.
- Weeks 2–12
We contact every manufacturer in their language and follow up until they answer or clearly refuse.
- Day 90
You receive the evidence file for each SKU and the gap list.
30 / 50manufacturers with complete evidence
If the evidence doesn't come in, you don't pay for the subscription
If fewer than 30 of your top 50 manufacturers have given complete evidence after 90 days, your subscription is free until they have.
This guarantee covers our evidence collection. It is not legal advice and not a conformity assessment. [NEED: contract clause]
Built for importers and distributors in the EU
A good fit if you
- import or distribute connected products (devices with firmware, an app, or a network connection)
- sell 50 or more of them
- buy many of them from manufacturers outside the EU
Not a fit if you
- buy only from EU manufacturers
Who runs this
Sabahattin Kalkan
A systems engineer who has spent [NEED: N] years on the distributor side of building technology, collecting product documentation from manufacturers. [NEED: confirm wording]
Questions
Is this legal advice?
No. We collect and organise evidence from your manufacturers. Your lawyer or compliance lead decides whether it is sufficient. [NEED: partner law firm, if any]
Why not just file the manufacturer's declaration of conformity?
Under Article 19 of the CRA, importers have to make sure the manufacturer also completed the conformity assessment, drew up the technical documentation, and supplied user information. A declaration on its own doesn't show all of that. [NEED: legal review]
Do our manufacturers have to pay or install anything?
They answer through a web form or by replying to our email. There is no cost to them.
Where is our data stored?
[NEED: hosting region, access control, retention period]
What does the pilot cost?
[NEED: pilot price]. After the fit call, a deposit of €[NEED] reserves your slot and is credited against the first invoice.
What happens after December 2027?
Products change and new vulnerabilities appear. We are building ongoing monitoring that keeps each evidence file current and alerts you when a product you sell appears in public lists of exploited vulnerabilities, such as CISA KEV and the ENISA EU Vulnerability Database. Pilot customers get it first.
Five pilot slots a month
The application takes two minutes. We reply within one working day.
- You apply with a few details about your portfolio.
- We book a 20-minute fit call to check the pilot suits you.
- If it does, a deposit reserves your slot and is credited against the first invoice.
Application received
We will reply within one working day to book your fit call.
Are you a manufacturer getting CRA requests from EU customers?
Tell us what your customers ask for and how many of them ask. We are mapping these requests so manufacturers can answer once.