01
Clarity over complexity
A law is only useful to you once it becomes a next step. I turn articles into actions, in plain language, with the reference always one click away.
00CRAnotify · About
Who I am
I’m an Enterprise Security Architect. My job is to take the weight of these rules off your shoulders.
The Cyber Resilience Act (Reg. UE 2024/2847) now asks every manufacturer of connected products to do what, until yesterday, only large security teams could. I built CRAnotify for one reason: to simplify these rules and put compliance within everyone’s reach — including a company with neither a legal department nor a security operations centre.
“Years spent designing security for large organisations taught me one thing: compliance doesn’t fail for lack of good intentions, but for lack of a clear path. I built CRAnotify to hand that path to everyone else.”
01The context
Enterprise-grade security, made accessible
- Early warning
- 24 hours · Art. 14
- Notification
- 72 hours · Art. 14
- Maximum penalty
- 2.5% of turnover · Art. 64
- Applies from
- 11 September 2026
01I’m Simone Nogara, an Enterprise Security Architect. For years my work has been to translate cybersecurity obligations into systems that real teams can operate — under pressure, against real deadlines, with an auditor waiting at the end. That work happens inside organisations with the budget to afford it, and I spent a long time on the wrong side of that line: writing procedures most companies would never have the resources to run.
The Cyber Resilience Act moves that line. From 11 September 2026 a manufacturer of connected products has 24 hours to raise an early warning and 72 to notify (Art. 14) — the same clock a bank runs, now ticking for a small hardware maker or a software house. Most of them have neither a legal team nor a security operations centre, yet the fine for getting it wrong reaches 2.5% of turnover (Art. 64). That asymmetry is exactly what I built CRAnotify to remove.
02The reason
Why I built CRAnotify
02A regulation is not a checklist you tick once. When an incident happens, the hard part is doing the right thing in the right order, fast, and being able to prove afterwards that you did. The deadline runs from a single fact — the moment you became aware — and everything after it has to be recorded, coherent and defensible. I have watched capable engineers freeze at exactly that point, not because they didn’t care, but because no one had ever handed them the sequence.
So I didn’t build another document generator. I built a system that qualifies the event, starts the clock, pre-fills the notification, keeps a tamper-evident record of every decision, and hands you a defensive dossier at the end. It prepares the filing; you submit it. My goal was one thing: on the worst day, when the clock is already running, you don’t have to work out what the rules mean — you already know what to do.
03What I believe
Three principles that decide what goes into the product and what stays out.
02
Evidence, not promises
Compliance you can’t prove is compliance you don’t have. Every decision is timestamped and kept in a tamper-evident registry you can hand straight to an authority.
03
Within everyone’s reach
The tools of a large security team, sized for a company that doesn’t have one. No jargon barrier, no consultant required before you can even begin.
04The company behind it
An independent project, close to the people who use it.
CRAnotify is developed and operated by Intarmour di Simone Nogara, based in Como, Italy. It’s an independent, focused effort — close to the product and close to the people who use it. When you write in, you reach the person who built it.
Contact
- info@cranotify.eu
- Como (CO) · Italia
Start here
Compliance shouldn’t require a security team. Let me be yours.
Check whether the CRA applies to you, or start the 14-day trial — no payment method required.