Secure & Comply / CRA and secure by design

Your product gets new obligations

The Cyber Resilience Act makes product security a fixed part of development and maintenance. We find where your product falls short and fix it in hardware and firmware, tested on real hardware.

Request a CRA Readiness Assessment See the timeline
Technical drawing of a circuit board with four security measures: a covered debug header, a secure element, a microcontroller with a lock, and an antenna receiving a signed update
  1. 1Debug interfaces locked
  2. 2Secure storage
  3. 3Secure boot
  4. 4Signed OTA updates
Secure & Comply / Where you stand

What the CRA means for your product

In scope

If your product has digital elements and is sold in the EU, the CRA most likely applies.

Unclear position

You do not know where your product stands today against the requirements.

Missing know-how

Secure boot or signed updates need embedded knowledge you may not have in-house.

Secure & Comply / The timeline

The CRA applies in three steps

395
Days until the CRA fully applies

On 11 Dec 2027.

10 Dec 2024In force

The CRA enters into force.

11 Sep 2026In force

Reporting obligation for actively exploited vulnerabilities and severe incidents.

11 Dec 2027In force

The regulation applies in full.

Source: Regulation (EU) 2024/2847

What that means for manufacturers
Secure by design
Vulnerability management
Secure updates
Security documentation
Following up and reporting vulnerabilities
Support during the product lifetime

Which category your product falls into is a legal question, and one for legal advice.

Secure & Comply / Our approach

Assess, fix, prove

Step 01Assess

We review the architecture, the firmware and your processes against the CRA.

Step 02Fix

We design and implement the measures in hardware and firmware.

Step 03Prove

We test them on real hardware and follow up after release.

Who does what
onEdge · engineeringGap analysis, then designing, implementing and testing measures on hardware.
Conformity assessmentBy the manufacturer, for certain categories by a notified body. onEdge is not one.
External partnersLegal advice and specialised security testing, through partners.
Secure & Comply / Faster through Kilby

Kilby speeds up, an engineer signs off

Kilby is our AI embedded engineer. He takes over work where that is faster. Experienced engineers decide and sign off on the result.

Meet Kilby ↗

KilbyWhere Kilby helps
  • Firmware analysis
  • Tests on hardware with every change
  • Documentation
What stays with engineers
  • The risk assessment
  • The choice of measures
  • Validation and release
Secure & Comply / Where to start
Kickstarter · First step

CRA Readiness Assessment

Know how ready your product is for the CRA.

We review your product against the CRA requirements: architecture, firmware and processes.

You getA gap analysis and a prioritised roadmap of engineering measures.
How it worksFixed scope, fixed price. An assessment is no guarantee of conformity.
Request the assessment
Next step · After the assessment

Fix the gaps in your product

Measures in hardware and firmware.

We implement the measures from the roadmap and test them on real hardware.

You getSecured hardware and firmware, tested, with technical documentation for your conformity assessment.
How it worksPhase by phase, in order of priority. You decide what goes ahead.
Plan a conversation
Contact

Bring us the hard problem.

A conversation about your problem is the first step.

Proven on real hardware