Skip to content
11 days until the Art. 14 reporting obligation (11 September 2026).
Documentation Support Risk class
00Pricing

One number decides the price: how many Products you manage. Everything else is included.

No modules, no seat count, no quote to chase. Move the slider and read your price. Try it 14 days without handing over a card, and pay nothing to switch it on. If you leave, you leave with everything: register and dossiers export in full, at the end of the period you already paid for.

01The price list

How many products do you manage?

Managed Products · type an exact number

1100+
€1,840/ month

or €18,400/year — 2 months free

Start the 14-day trial

No credit card

SKUs, GTIN/EAN codes, variants, hardware revisions and firmware versions are all included in the managed Product.

02Everything included

Nothing is sold separately. It is all in the price you just read.

  • Managed Product workspace, with unlimited SKUs, GTIN/EAN identifiers and variants inside each one
  • Unlimited releases and firmware versions, subject to reasonable use
  • Manual SBOM upload, plus automatic ingestion through the available integrations
  • Vulnerability intelligence, with human assessment: the engine proposes, a person decides
  • Guided triage: the regulatory engine tells you whether this one is reportable
  • Deadline clock running from hour zero, with email reminders nobody has to set
  • Evidence workspace and defensive dossier in PDF, ready to hand to an authority or a customer
  • Public reporting form, so a finding lands in a case and not in somebody's inbox
  • Roles for manufacturer, importer and distributor, with escalation tiers and Slack/Teams alerts
  • Tamper-evident audit trail: proof of what you decided, and when
  • Exercise mode: run a simulated incident end to end before a real one arrives
  • API and webhooks with per-key permissions, and OIDC SSO with two-step verification
  • Unlimited cases, reports and users

Prices exclude VAT. Unlimited SKUs, identifiers and releases within each Managed Product, subject to reasonable use. One boundary worth stating plainly: CRAnotify prepares the notification, you file it on the ENISA single reporting platform.

03What counts

What is a Managed Product?

A Managed Product is a product family you manage under a substantially shared product and CRA operational context. SKUs, GTIN/EAN codes, regional variants, hardware revisions and firmware releases live inside it, and are not billed individually.

This is a commercial definition, and it stops there. Whether a set of SKUs is legally one product under the CRA is not something software decides: the resolution engine can suggest a grouping, a person confirms it, and billing follows the registry — never the other way round.

AIndustrial manufacturer

Five families, dozens of codes

Product families
5
SKU
87
Firmware releases
14
Billed Managed Products
5

€1,095 / month

BEU importer

Many identifiers, one catalogue

Product families
25
GTIN
1,840
Manufacturers
several
Billed Managed Products
25

€3,775 / month

CLarge distributor

Thousands of codes, one hundred products

Catalogue identifiers
thousands
Variants and revisions
included
Billed Managed Products
100

€12,700 / month

04Large perimeters

Managing 100+ products?

The slider keeps showing the list price up to 100 Managed Products, so you can see the model rather than guess at it. Above that the price is agreed, not listed. Volume pricing for large manufacturers, importers and distributors.

05The cost of not complying

Hour 24 arrives whether or not you have a process.

From 11 September 2026 the Art. 14 reporting duties apply: early warning within 24 hours, notification within 72, then a final report. Breaching the Art. 13 and 14 obligations can carry fines up to €15M or 2.5% of annual worldwide turnover, depending on the breach and the circumstances. And a smaller bill usually arrives first: a customer in a tender asking for your documentation, with days to answer.

up to €15M

or 2.5% of annual worldwide turnover for breaching the Art. 13 and 14 obligations

Art. 64

market withdrawal

a measure the surveillance authority can order where risk is unmanaged

Art. 52

lost tenders

the quiet one, and the one that arrives first: buyers want documented proof that you handle vulnerabilities

06Questions

Frequently asked questions.

Start now

Open a case, take it to the finished dossier, then decide. 14 days, no card, no automatic charge.