Self-serve
The CRA kit: the sprint's tooling, without the workshop.
Everything the CRA-Ready Sprint installs and fills in with you — packaged for teams who'd rather wire it themselves. One price, your pipeline emits compliance evidence by the end of the day.
What's in the kit
The GitLab CI evidence component
Four jobs you include in your pipeline: CycloneDX SBOM, vulnerability scan, a release gate on the CISA Known Exploited Vulnerabilities catalogue, and cosign keyless signing — every release emits a signed, dated evidence bundle with a schema-validated manifest. A failed gate still archives its evidence.
The document pack — eight templates
Scoping memo, Annex I risk assessment, CVD policy + security.txt, vulnerability-handling SOP, user security information, technical documentation skeleton, Declaration of Conformity draft, support period policy. Regulation passages quoted verbatim from the EUR-Lex consolidated text, with a fill-in guide in every file.
The Article 14 reporting runbook
The is-this-reportable decision tree, the 24/72-hour clock as a checklist with an owner per step, three pre-filled report forms, and a 60-minute tabletop exercise your team can run without a facilitator.
The obligations register
Every manufacturer duty in the regulation as a row — owner, recurrence, link to evidence — with a generator that renders it as markdown and Airtable-ready CSV. One export when a customer or authority asks.
Is the kit enough, or do you need the sprint?
The kit fits teams with someone comfortable in GitLab CI who can spend a day wiring the component and a few evenings filling the documents against their own product. If you want the scoping decided with you, the documents filled in a working session, and your team drilled on the 24-hour clock — that's thetwo-week sprint, and the kit's full price is credited if you upgrade within 30 days.
Buy the kit — €349
One-off. Checkout and VAT handled by Stripe; delivered to your email as a private repository invitation within one business day. Includes updates through 11 December 2027.
The kit is engineering tooling and document templates, not legal advice — verify against Regulation (EU) 2024/2847. Independent service, not affiliated with or endorsed by any regulator.