The CRA's 24-hour reporting duty has applied since 11 September 2026. Check whether it reaches you
Start the system

For software development companiesproducts and client builds, all of the EU

Ship software into the EU. Keep each product's file current.

The Cyber Resilience Act reaches the software you sell and the builds you hand over to clients, and buyers ask for ISO 27001 either way.

Start your compliance system Check if the CRA applies to you
Example data

The rules that reach you

What reaches a software house, and from when

One law covers each product you ship, one standard your buyers ask for, and two more depend on what you build.

Cyber Resilience Act

Regulation (EU) 2024/2847 · Products with digital elements

Every product you place

Software you place on the EU market that connects to a device or a network, with the manufacturer's duties of Article 13 on you.

24 hEarly warning of an actively exploited vulnerability, products already sold includedArt 14
Class IPassword managers, browsers, VPNs and operating systems are important productsAnnex III
Client buildsSoftware built for one client and handed over is made available on the market tooArt 3(22)
SaaSOutside, unless it is the remote data processing of a productRecital 12
Art 13Reporting since In full from

ISO 27001

ISO/IEC 27001:2022 · a standard

Not a law

Buyers ask for the certificate, and most tenders that name it are for software and IT work.

Annex A, 93 controlsYour clients set the date

Data Act

Regulation (EU) 2023/2854

If you sell SaaS

Chapter VI lets your customers switch to another provider, on terms in the contract, with switching charges at zero from 12 January 2027.

Chapter VIArt 29Since No switching charges from

AI Act

Regulation (EU) 2024/1689

If you build AI features

If your software has an AI feature that talks to people, Article 50(1) has you tell them they are dealing with an AI system.

Art 50(1)Since

In numbers

What buyers ask for, and how long you have

2,055 of3,403

ISO 27001 tender notices were for software or IT services, 60% of all in the year to 10 October 2026.

Source: TED, main classification CPV 48 or 72, read 11 October 2026

until the Cyber Resilience Act applies in full.

Source: Regulation (EU) 2024/2847, Article 71(2)

23

kinds of product are important under Annex III, password managers, browsers and operating systems among them.

Source: Regulation (EU) 2024/2847, Annex III

What StandardOS does for a software company

One file per product, and the ISMS behind them

Every tile is a screen in the product today.

One technical file per product

Each product's tier, technical documentation, SBOM and support period, kept current as it changes.

The Article 14 clocks, counted

From the moment you become aware of an actively exploited vulnerability, each report's deadline is on screen.

Your ISMS, drafted

ISO 27001 with its Statement of Applicability and policies drafted for you to approve.

Questionnaires answered from your records

Paste a client's questions and each answer is drafted from your controls and evidence, with its source.

One subscription

Every rule on this page, on one record.

ISO27001CRANIS2DORAISO42001AIACTISO9001MRGDPRDATAACTISO27701EAAISO14001PLDREDGPSRNIS2IRRoHSREACHWEEEPPWRWBBATPTDEUDREEDCER

The 4 on this page, and 23 more for the same price

€249/mo

Every framework included.

excl. VAT, per organization

  • Unlimited users, auditors included
  • 7 days free, no card, no sales call
Start your compliance system

Or one file, once: CRA Readiness Toolkit, €199See the pack

Questions

What software houses ask first

Short answers, each with the article it rests on.

Does the CRA apply to software we build for one client?

Yes, once you hand it over: supplying it for use in the course of business is making it available on the market. For a tailor-made product, you and a business client may agree other terms on its default configuration and on free security updates.

Art 3(22)Annex I
We only sell SaaS. Is it in scope?

Not as a product. Recital 12 leaves software as a service to NIS2, unless it is the remote data processing a product of yours needs to work.

Recital 12Art 3(2)
What do we owe since 11 September 2026?

Article 14 reporting: an early warning within 24 hours of becoming aware of an actively exploited vulnerability, for products already on the market too.

Art 14Art 69(3)
Is our product important or critical?

Only if Annex III or IV lists it, password managers and browsers among them. Everything else is in the default category, and you assess conformity yourself.

Annex IIIArt 32(1)
Do we need ISO 27001 for the CRA?

No. The CRA has its own essential requirements in Annex I. ISO 27001 is what buyers and tenders ask for, and we publish the map between the two.

Annex I

Start with one product. Add the rest when ready.

7 days free, no card and no sales call.

Start your compliance system Check if the CRA applies to you

This page in:DeutschFrançaisNederlandsEspañolDansk