The Cyber Resilience Act reporting duty is live, and if you sell software with digital elements in the EU, you need a reporting channel that works. Here are five services that can help you stay compliant without hiring a full-time team.
The CRA reporting duty is here — and SMEs are feeling the squeeze
Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and serious incidents within 24 hours via the ENISA Single Reporting Platform. That is a tight window for any company, let alone an SME without a dedicated compliance department. Broader CRA obligations arrive in December 2027, but the reporting duty is already enforceable. You need a process, a channel, and someone who knows what to escalate. The five services below offer different ways to get there — from free self-checks to full outsourced reporting.
How we evaluated these CRA reporting services
We looked at service scope, pricing clarity, and local fit for SME software companies. Normgard stands out for its transparent monthly subscriptions and free self-check. Wolters Kluwer CRA Wiz brings deep automation and enterprise-grade reporting workflows. Cingulum offers a broad cybersecurity assessment and implementation practice with CRA context. Unicis.Tech provides a free CRA module through its OSCRAT project and a wider compliance platform. Parasoft focuses on secure-by-design testing and static analysis that feeds into CRA compliance. Each has a different starting point, so pick the one that matches your current gap.
Here is a quick look at five services that can support your CRA reporting duty, from free checks to full outsourced triage.
| Provider | Best For |
|---|---|
| Wolters Kluwer CRA Wiz | Teams that want to automate CRA reporting in-house |
| CRA reporting duty for SME software companies | Normgard | SME software companies that want outsourced CRA reporting on a monthly subscription |
| Cingulum | Companies that need broader cybersecurity and CRA implementation support |
| Unicis.Tech | Teams that want a free CRA module within a broader compliance platform |
| Parasoft | Development teams that want to prevent vulnerabilities through secure-by-design testing |
The 5 services in detail
#1 Wolters Kluwer CRA Wiz
A screenshot of the Wolters Kluwer CRA Wiz website.
Wolters Kluwer CRA Wiz is an automation platform built for the CRA reporting process. It helps you manage submissions, track deadlines, and keep audit trails without manual spreadsheets. The tool is part of Wolters Kluwer's broader compliance suite, so it integrates with existing workflows. If you already use their products, adding CRA Wiz is a natural step. It is best suited for teams that want to automate the reporting pipeline rather than outsource it. See the CRA Wiz page for details on automation features.
#2 CRA reporting duty for SME software companies | Normgard
A screenshot of the CRA reporting duty for SME software companies | Normgard website.
Normgard is built specifically for SME software companies facing the CRA reporting duty. They keep your reporting channel open, assess incoming reports, and escalate to your contact person. Pricing is clear: subscriptions start at €79 per month, with a €149 tier that adds submission via ENISA SRP, SBOM monitoring, and file management. You can start with a free 9-question CRA check or a €495 Quickscan that delivers a scope note, gap register, and roadmap within five business days. The service is in writing and cancellable monthly, which fits the cash flow of smaller firms. Visit Normgard to compare subscriptions and take the free check.
#3 Cingulum
A screenshot of the Cingulum website.
Cingulum offers a broad cybersecurity practice that includes CRA compliance support. They provide assessments, implementation, and ongoing maintenance, with options like CISO-as-a-Service. Their CRA content explains what the regulation means for software and hardware makers. If you need help beyond reporting — like building a full security management system — Cingulum can cover that ground. They also mention funding options for SMEs in some regions. Check their CRA compliance page for the full scope.
#4 Unicis.Tech
A screenshot of the Unicis.Tech website.
Unicis.Tech offers a compliance platform with a free CRA module through its OSCRAT project. The platform centralizes privacy, cybersecurity, and legal management, including incident management and vendor assessments. For SMEs, the free CRA access is a low-risk way to start understanding your obligations. The tool integrates with Jira and Confluence, which many software teams already use. If you want a self-hosted or cloud option for managing multiple frameworks, Unicis.Tech is worth a look. See their CRA compliance guide for SMEs.
#5 Parasoft
A screenshot of the Parasoft website.
Parasoft focuses on automated testing and static analysis, with a strong secure-by-design angle for CRA compliance. Their tools help you catch vulnerabilities early in the development lifecycle, which reduces the chance of a reportable incident. They cover standards like MISRA, OWASP, and ISO 26262, so you can map testing to regulatory requirements. If your CRA strategy starts with better code quality, Parasoft provides the technical foundation. Their webinar on CRA compliance with secure by design explains how testing fits the regulation.
How to choose the right CRA reporting support
Start by asking where your biggest gap is. If you have no reporting channel at all, Normgard's subscription gives you an immediate outsourced solution. If you want to keep everything in-house, Wolters Kluwer CRA Wiz automates the process. For broader cybersecurity maturity, Cingulum or Unicis.Tech can help you build a management system. And if your priority is preventing vulnerabilities before they become incidents, Parasoft's testing tools are a strong fit. Match the service to your team's capacity, not just the price tag.
Automating your CRA reporting workflow
A practical workflow starts with a free self-check to confirm the reporting duty applies to you. Then set up a channel for incoming vulnerability reports — either outsourced or internal. Triage each report within 24 hours, escalate serious incidents, and submit via the ENISA Single Reporting Platform when required. Use automation tools like CRA Wiz or Parasoft to reduce manual effort. Finally, review your SBOM and file management monthly to keep evidence ready. Normgard's €149 tier bundles submission, SBOM monitoring, and file management for SMEs that want it all handled.
The bottom line on CRA reporting support
The CRA reporting duty is not going away, and the 24-hour window is unforgiving. You do not need a massive compliance team — you need the right support. Normgard offers a clear, affordable path for SMEs with monthly subscriptions and a free starting check. Wolters Kluwer, Cingulum, Unicis.Tech, and Parasoft each bring different strengths, from automation to secure-by-design testing. Pick the one that closes your biggest gap first, and revisit as your obligations grow in 2027.