CRA compliance on autopilot for small software makers

Since 11 September 2026, manufacturers must report actively exploited vulnerabilities within 24 hours - including for products already on the market. Earlybell watches your code every day and drafts the reports for you. You just press send.

Free check: does the CRA apply to me? Join the early access list
sbom.cdx.json - release v2.4.1 ✓ SBOM generated 
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "version": 1,
  "metadata": {
    "timestamp": "2026-10-08T09:12:00Z",
    "component": { "type": "application", "name": "your-app", "version": "2.4.1" }
  },
  "components": [
    { "type": "library", "name": "openssl", "version": "3.0.15",
      "purl": "pkg:generic/openssl@3.0.15" },
    { "type": "library", "name": "lodash", "version": "4.17.21",
      "purl": "pkg:npm/lodash@4.17.21" }
  ]
}

Who it is for

EU micro-companies selling paid apps, WordPress or Shopify plugins, SDKs or devices with firmware. Not sure if you are in scope? The free check tells you in a few minutes.

What we do every week, so you don't have to

  • SBOM generated with every release
  • Daily vulnerability check of your dependencies
  • Ready-to-send drafts of the 24-hour early warning and the 72-hour notification
  • Coordinated vulnerability disclosure policy and security.txt, kept up to date
  • Technical documentation kept ready for 11 December 2027
earlybell · daily check · 2026-10-08 
✓ 142 dependencies checked
✓ No actively exploited vulnerabilities
! 1 new advisory (not exploited): lodash 4.17.21 - review suggested
  Draft 24h early warning: not needed

How it works

  1. Connect your repository.
  2. We scan every release and every day.
  3. When something needs reporting, you get a draft - you review it and submit it via the ENISA platform.
/.well-known/security.txt ✓ Kept up to date 
Contact: mailto:security@your-company.eu
Expires: 2027-10-08T00:00:00Z
Policy: https://your-company.eu/security-policy
Preferred-Languages: en, de
Canonical: https://your-company.eu/.well-known/security.txt

The deadlines

24 h
early warning
72 h
notification with initial assessment
14 days
after a fix is available - final report
11 December 2027
full CRA obligations (CE marking, technical documentation)

Price

49 EUR per product per month, excl. VAT. Pay yearly and pay for 10 months only.

Nothing to pay now - this is the price when we start.

Why not a free tool? Free tools generate an SBOM once. The CRA needs someone to watch it every week and to act within 24 hours. That is what you pay us for.

We prepare drafts and documentation; you stay the manufacturer and you submit reports yourself. We are not a notified body.

FAQ

Is SaaS covered?

A web app used only in the browser, with nothing to install, is outside the CRA. If you also ship an app, plugin, SDK or device that needs your backend, the CRA covers that product together with the backend. The free check tells you which case you are.

What if I have several products?

The price is per product: 49 EUR per month each, excl. VAT.

What do you need access to?

Read-only access to your repository.

Can I cancel?

There is nothing to pay now. You can leave the list with one click in any e-mail from us.

Guides

CRA 24-hour reporting: what a micro company selling software must do since 11 September 2026