CRA Compliance
Shouldn't Cost a Fortune
Complaro gives you everything for free — SBOM analysis, vulnerability scanning across OSV.dev, CISA KEV, and GitHub Advisories, ENISA report generation, and a full compliance dashboard. No limits, no paywalls, no account gates.
CRA Readiness Scanner
Enter a public GitHub repository and get an instant CRA readiness score. See what's missing before the September 2026 deadline.
From SBOM to CRA Compliance Readiness
Three steps between uploading your first SBOM and generating a compliance-ready incident report draft.
Identify and Classify Your Products
Upload your Software Bill of Materials or let cra-scanner detect one. The platform maps every component against CRA Annex III and Annex IV to determine your product classification and which essential requirements apply.
Scan for Known Vulnerabilities
Complaro matches your SBOM components against NVD, CISA Known Exploited Vulnerabilities, and GitHub Security Advisories. Version-aware matching reduces false positives while flagging actively exploited CVEs that trigger the 24-hour ENISA reporting obligation.
Generate ENISA-Format Reports
Export pre-filled vulnerability reports in the three CRA-mandated formats: 24-hour early warning, 72-hour incident notification, and 14-day final report. Available as PDF and machine-readable JSON.
Purpose-Built for the EU Cyber Resilience Act
Unlike general-purpose vulnerability scanners, Complaro is designed specifically for CRA compliance. The platform understands CRA product classification and scores your readiness across five compliance dimensions.
CI/CD Integration
Connect Complaro to your development workflow. Scan SBOMs automatically on every release and catch compliance issues before they ship.
24-Hour Vulnerability Reporting
When a CVE hits your dependencies, Complaro flags it, helps assess your reporting deadline, and generates pre-filled ENISA-format reports before your team has finished their morning coffee.
ENISA Report Generation
Reports come pre-filled with data from your scan. Add the details only your team knows, export as PDF or JSON, and submit to ENISA.
Multi-Product Dashboard
Manage compliance across your entire product portfolio from a single interface. Track everything per product.
Everything You Need. Nothing to Pay.
We believe compliance tooling should be accessible to every team — from solo developers to large organizations. Every feature is included, always.
Vulnerability Reports in Minutes, Not Weeks
The CRA gives you one day to report an exploited vulnerability. Complaro helps you generate the report in minutes.
Built for Engineers
Made for the team that actually manages dependencies, not for consultants filling out PDFs.
Every Product. One View.
Whether you ship one product or a hundred, every compliance score and deadline lives in the same dashboard.
Fits What You Already Use
Imports SBOMs from Snyk, Sonatype, Trivy, or your own pipeline. Nothing to rip and replace.
Always Watching
NVD, CISA KEV, and GitHub Advisories are checked continuously. You hear about new threats before your morning standup.
Not a Consulting Invoice
Traditional CRA assessments can cost tens of thousands in consulting fees. Complaro is free.
CRA Compliance Badge
Show your CRA readiness on your GitHub README. The badge updates daily.
Who We Are
Complaro is a Copenhagen-based team focused exclusively on EU Cyber Resilience Act tooling. We build open source tools including cra-scanner, a free CLI for CRA readiness assessment, and this platform for teams that need continuous compliance management.
About usYour Questions, Answered
Answers to your most common questions about the CRA and Complaro.
Is My Product in Scope?
Answer a few questions to find out if the CRA applies to your product and what category it falls under.
Does your product contain software or firmware?
Get in Touch
Questions about CRA compliance or Complaro? We'd love to hear from you.
Full CRA compliance tooling.
No cost. No limits.
SBOM analysis. Vulnerability scanning. ENISA reports. Compliance dashboard. CI/CD integrations. All of it. Zero cost.