EU CRA platform for multi-product manufacturers
A hundred variants. Maintained once.
Whether you ship 50 or 500 variants, with or without a regulatory expert in-house: Kunnus walks every product through classification, knows the components your products share, and takes each variant all the way to the EU declaration of conformity.
The EU Cyber Resilience Act applies to every variant in your portfolio: reporting obligations since 11 September 2026, including for products already on the market, and full application from 11 December 2027. All deadlines at a glance
Why a platform
Per product. Ongoing. On the record.
Three properties of the EU Cyber Resilience Act turn portfolio compliance into a management task: the obligations apply per product, they run for the whole support period, and every one of them has to be proven on request.
Per product
Classification, risk analysis, SBOM, technical documentation and the EU declaration of conformity apply to each product with digital elements on its own (Art. 13, Annex VII, Art. 28). Two variants are two sets of evidence.
Ongoing
Vulnerability handling and security updates run for the entire support period, at least five years (Art. 13(8)). The SBOM changes with every release, and the 24-hour reporting clock has been running since 11 September 2026 (Art. 14).
On the record
A market surveillance authority can request the technical documentation of any single product, and it has to be kept for at least ten years (Art. 13(13)). The evidence has to exist per variant, on the day of the request.
At 200 variants that is 1,200 sets of evidence before the first release lands. You keep your bill of materials in an ERP for exactly this reason. EU CRA evidence needs the same kind of home: one system that knows your products, components and obligations and keeps them connected.
No regulatory expert in-house
Kunnus knows the regulation. You know your products.
What applies to a product follows from its classification. Kunnus runs the classification wizard under Annex III and IV, derives the obligations that apply to that exact product, and turns each one into a task with an owner and a deadline. For every step, Kunnus shows which article requires it and what counts as evidence.
- Classification with a documented rationale, assessment route included: self-assessment or notified body
- A roadmap per product: only the steps that apply to it, in the order the regulation sets
- The reporting cascade to the coordinating CSIRT and ENISA set up with its deadlines: 24 hours, 72 hours, 14 days
- One named contact at Kunnus, plus the open knowledge base on every article
Hundreds of variants
One component, every variant that contains it.
With many variants the software is shared, but the obligation stays per product. Kunnus maps families and variants as a hierarchy and knows, for every component, which products contain it. That mapping is what produces SBOM versions and tasks per variant.
- Product families as a hierarchy: shared SBOM base and vulnerability process inherited, risk class and support period per variant
- Component updates land in the SBOMs of all affected variants
- Which products contain log4j 2.14? Answered in seconds, across the whole portfolio
- Before a shared component changes, the hierarchy shows which variants are affected and which conformity assessment needs another look
How far along are we?
One status for the whole portfolio.
The question comes from the board, from the OEM customer and from the notified body. Kunnus answers it per product and for the whole portfolio: which products are conformant, what is open, who completes it by when, and what is still due before full application on 11 December 2027.
- Conformity status per product and per family
- Open tasks with owners and deadlines
- Audit trail: who changed what, and when
How your portfolio gets into the platform
Product list
Families and variants become a hierarchy in the inventory, each with its classification.
SBOMs per build
The open-source scanner generates SBOMs per build artifact, CycloneDX or SPDX, and assigns them to the variants.
Vulnerability triage
New CVEs are matched across the portfolio and tasks are created per affected variant, with a deadline from your SLA.
Evidence per variant
Documentation and the EU declaration of conformity, retrievable per variant.
Frequently asked questions
Do we need a regulatory expert in-house for the EU Cyber Resilience Act?+
Classification under Annex III and IV runs as a guided wizard, the obligations per product sit in a roadmap with their legal reference, the technical documentation is pre-structured under Annex VII, and the Art. 14 reporting paths carry their deadlines. A named contact at Kunnus answers what the wizard does not settle. For important products (class I without fully applied harmonised standards, and class II) a notified body is involved in the conformity assessment.
When does a platform for multiple product variants pay off?+
As soon as several products share the same components. From then on, every new vulnerability and every component update affects several variants at once, while each variant still needs its own SBOM, classification and evidence under the EU Cyber Resilience Act.
What happens to our existing compliance history when we move from spreadsheets to the platform?+
Onboarding starts with an import of your current state: the product list, existing SBOMs and documents. From the import onwards, the platform records every change with attribution, and the history stays retrievable for the ten-year documentation period of the Cyber Resilience Act.
Do the obligations apply per variant when components are shared?+
The manufacturer obligations under Art. 13 of the EU Cyber Resilience Act apply to each product with digital elements individually, even when variants contain the same components. A vulnerability in a shared component therefore has to be handled in every product that contains it.
How does variant inheritance handle products with different risk classes?+
Variant inheritance applies to shared attributes (SBOM base, vulnerability handling process, support period policy). Risk class is set per variant because Annex III classification depends on product-specific factors like connectivity, intended use, and criticality.
What's the relationship between this multi-product approach and the Kunnus Enterprise plan?+
The multi-product capabilities described here are available across plans. The Kunnus Enterprise plan adds role-based access tiers, multi-team workflows, integration into PLM and CI/CD systems, and dedicated implementation support, for portfolios with hundreds of variants and multiple engineering teams.
Kunnus EnterpriseSee Kunnus on your own portfolio.
We model your product families, map the shared components and show how one change runs through the variants.
A product list is all it takes to start.