Skip to content
← Services

CRA compliance, built into your development

From Switzerland, we audit your products, tool up your CI/CD and fix your code: not one more report, the work done in your repository.

Check my product in 3 min Book a first read

What we do, and what it costs

Four offers: you come in through the one that matches your situation.

  1. Starting point

    Audit

    “Where do we stand?”

    Risk assessment, gaps in your CI and your code: your costed CRA roadmap.

    Not invoiced if your product is out of scope, deducted from the next step if you go ahead.

    CHF 6,000

    fixed price

  2. Tool up

    “We need the SBOM and the monitoring.”

    An SBOM at every build, Dependency-Track on your side, a tested reporting procedure.

    from CHF 12,000 for SBOM + Dependency-Track

    On quote

    depending on your chain

  3. Monitor

    “Nobody has time to read the alerts.”

    Every new CVE assessed by an engineer: does it affect you, and what should you do?

    On quote

    per month, per product

  4. Fix

    “Now it has to be fixed.”

    Security mechanisms and fixes delivered in your code, all the way to integration.

    CHF 1,600

    per day, within your budget

Not ready for an audit?

One shipped version of your product: its components and the known CVEs affecting it. Deducted from the audit if you go ahead.

CHF 900 no bare metal

One hour, free and with no commitment, to find out which offer to start with.

Book a first read
The offers in detail
Audit: Risk assessment and gaps
We establish your CRA scope and the cybersecurity risk assessment required by Article 13, then measure the gaps in your CI and your code against Annex I. You leave with a prioritised, costed roadmap, written so your team can carry it out on its own.
Tool up: CI/CD, SBOM, Dependency-Track and reporting
SBOM at every build, CVE scanning in your pipeline, Dependency-Track on your side, a tested reporting procedure. Every shipped version is inventoried and monitored, and your team knows how to report.
Monitor: Assessing new CVEs
Every month, an engineer assesses your product's new CVEs: do they affect you, and what should you do? You no longer read alerts: you receive decisions.
Fix: Bringing the code into compliance
Security mechanisms, fixing CVEs and gaps, all the way to integration in your code. We don't stop at the finding: we deliver the fix, and review your design and merge requests against Annex I.
What the audit covers

Together with your technical team, we establish:

  • your scope and obligations: product in scope or not, your role (manufacturer, importer, distributor), your class, the timeline;
  • the cybersecurity risk assessment (Article 13), reusable in your technical documentation;
  • the gaps in your chain (build, CI/CD, releases): what connects as is, what is missing;
  • the gaps in your code against the Annex I essential requirements;
  • the prioritised roadmap, costed item by item, which your team can carry out on its own.

Several products? We start from the pilot product of your choice, and the audit estimates the effort and budget for the others.

Who does what The CRA binds the manufacturer. We do the technical work; decisions and signatures stay with you.

Risk assessment

ADNT · We carry it out with your team and write it up.

You, the manufacturer · You approve it and add it to your technical documentation.

Inventory (SBOM)

ADNT · We build its generation into every build.

You, the manufacturer · You keep it in your technical documentation.

Vulnerabilities

ADNT · We set up monitoring and assess new CVEs.

You, the manufacturer · You decide which fixes to ship and when.

Code

ADNT · We deliver the fixes in your code and your CI/CD.

You, the manufacturer · You approve and release the updates.

Reporting to ENISA

ADNT · We prepare the procedure and templates, and stand by you on the day.

You, the manufacturer · You send the 24 h early warning and the 72 h notification: the obligation stays yours.

Conformity

ADNT · We assemble the technical evidence.

You, the manufacturer · You sign the EU declaration of conformity and affix the CE marking.

Are you in scope?

  1. 11.09.2026

    In force

    Vulnerability reporting

    An actively exploited vulnerability must be reported to ENISA: early warning within 24 h, notification within 72 h, final report within 14 days. Products already shipped included.

  2. 11.12.2027

    Full application

    Software inventory (SBOM), secure design, security updates throughout the support period, CE marking.

  • All of your products on the market, even those shipped years ago
  • 0 exemptions for SMEs, Swiss or not
  • €15M or 2.5% of worldwide turnover: the maximum penalty

Not sure your product is in scope? Check my product in 3 min The check takes 3 minutes, no email required.

Manufacturing in Switzerland? Read what the CRA changes for a Swiss SME: your obligations case by case, and the draft federal law.

Florian Mahon
Florian MahonFounder, software and firmware engineer

We apply the method to our own products first.

For your technical team

We start from your products, your code and your build chain, not from a questionnaire. Everything plugs into your existing flow, with no parallel chain.

  1. Commit

    Your code, pushed

  2. CI/CD

    Build and tests

  3. SBOM

    CycloneDX inventory, generated at every build

  4. Dependency-Track

    Monitors every shipped version

    • zephyr3.7.0No CVE
    • mbedtls 3.5.2 Fixed
    • littlefs2.9.1No CVE

    Fix shipped: new build, new SBOM.

Every fix flows back into the chain: SBOM regenerated, monitoring up to date. The cycle continues.
See the 5 questions and our chain, step by step

Can you answer yes to these five questions?

  1. 1.Do you know exactly what is in every shipped product?
  2. 2.Can you identify the affected versions when a new CVE appears?
  3. 3.Can you link them to deployed products and to your customers?
  4. 4.Do you have a written vulnerability handling process?
  5. 5.Can you produce the required evidence continuously, without manual work?

Where it gets hard, and what we do about it

SBOM

CycloneDX or SPDX, produced by your build.

The trap: vendor SDKs and C/C++ code copied into the repository, invisible to scanners. We inventory them too.

CVE scan

In your pipeline, with a threshold that fails the build.

The trap: hundreds of alerts, most of them irrelevant. We check whether the vulnerable code is actually called in your firmware.

VEX

False positives documented in a standard format.

The trap: triage that nobody maintains and that decays within months. We set it up as a team routine.

Dependency-Track

Continuous monitoring of shipped versions.

The trap: knowing a version is vulnerable without knowing which customers run it. We link every version to deployed products.

security.txt

A published disclosure channel.

The trap: an address nobody reads. We connect it to the handling process.

PSIRT

The vulnerability handling process.

The trap: a procedure that was never used and stalls on a Friday at 11 pm. We write it with your team and test it with a dry run.

At every build, the evidence (inventory, analyses, decisions, test results) is archived automatically, ready the day an auditor asks for it.

Let's talk about your product

One hour, free and with no commitment. We go through your situation together and you leave with a first view: likely scope, likely class, next steps.

Book a first read +41 76 639 30 70

ADNT Sàrl

Rue du Pont 8, 1er étage, 2400 Le Locle, Suisse

We travel throughout French-speaking Switzerland: Neuchâtel, Vaud, Jura, Bern, Fribourg, Geneva.

info@adnt.io

References