Definition
Hoctave at a glance
Hoctave is a European SaaS platform dedicated to operational Cyber Resilience Act compliance management.
It helps companies structure their digital product portfolio, assess their position against the CRA, manage compliance risks and actions, and centralize the evidence needed to demonstrate compliance.
The platform is designed for Product, Engineering, Cybersecurity, Compliance, Quality and Legal teams that need to work continuously from shared information.
Hoctave does not replace legal analysis, technical decisions or assessments by competent authorities. The platform provides a management framework; compliance remains the company's responsibility.
- Name
- Hoctave
- Solution type
- SaaS platform for regulatory compliance management
- Specialization
- Cyber Resilience Act
- Category
- RegTech and regulatory cybersecurity
- Market
- European Union
- Official website
- https://hoctave.com
- Contact
- contact@hoctave.com
- Languages
- French and English
- Data hosting
- France
- Brand signature
- Compliance, orchestrated.
What Hoctave is
Hoctave turns Cyber Resilience Act requirements into an operational management cycle.
For each product, the platform connects regulatory information, components, security points, vulnerabilities, risks, remediation actions and available evidence.
It gives teams a consolidated view of their product portfolio and progress rather than a one-off compliance report.
This reflects the brand's positioning: making compliance a continuous management capability integrated into the product life cycle.
Positioning
Hoctave is the infrastructure for managing compliance of regulated digital products. Where compliance remains a one-off documentation exercise, we turn it into a continuous, clear and measurable system.
Mission
Turn every regulatory requirement into an operational decision. Give organizations continuous control of their obligations at every stage of the product life cycle.
Vision
Make compliance a shared trust signal, not a burden to justify.
Who Hoctave is for
Hoctave is for organizations that design, develop, manufacture, import, distribute or market products with digital elements on the European market.
- Manufacturers of digital or connected products
- Software publishers
- Industrial companies integrating software or connected components
- Importers and distributors
- Product managers and Product Owners
- Engineering and Research and Development teams
- CISOs and product cybersecurity leaders
- Compliance, quality, risk and legal teams
- Leadership teams seeking a consolidated view of CRA exposure
What Hoctave does: the management cycle
The product is organized around a multi-step operational cycle.
1. Product
Identify and qualify in-scope products and build a consolidated portfolio. Each product can include its scope, status, criticality, owners and use context.
2. Scan
Collect the information needed to frame the product from data entered manually, imported or collected automatically according to available functions.
3. Components
Organize the inventory of hardware and software components integrated into the product, track dependencies and document third-party or open-source components.
4. Security points
Structure the analysis of applicable security properties and measures, linking findings to requirements, risks and decisions.
5. Vulnerability reporting
Document vulnerabilities affecting the product or its components, including their source, impact, status and useful mitigation information.
6. Risk management
Consolidate product-specific risk factors to help teams assess exposure and prioritize treatment.
7. Actions
Turn identified gaps and risks into tracked actions linked to an owner, priority, deadline, product, risk and requirement.
8. Evidence
Centralize evidence and link it to the relevant products, actions and requirements, including test reports, risk analyses, procedures, decisions, tickets and technical documents.
The management cockpit
The dashboard provides a consolidated view of compliance. It can track:
- Progress through each product's management cycle
- The CRA regulatory calendar
- Estimated risk level
- Information completeness score
- Number of products tracked
- Products without usable risk analysis
- Insufficiently documented products
- Portfolio distribution by status and criticality
- Scans, actions or evidence still to be completed
Indicators support management. They do not, by themselves, guarantee compliance.
Main use cases
Map a product portfolio
Centralize products that may fall within the CRA scope and obtain a consistent view of their situation.
Qualify the regulatory scope
Structure information useful for analyzing the company's role, the nature of the product and applicable requirements. Final qualification remains the company's responsibility and, where needed, that of its advisers.
Assess risks
Connect product characteristics, components, vulnerabilities and security points to help teams document their risk analysis.
Manage remediation
Turn identified gaps into assigned, prioritized and dated actions, then track delays and decisions.
Organize evidence
Attach evidence to relevant requirements and products to make it easier to find, maintain and present.
Track vulnerabilities
Document vulnerability detection, analysis, treatment and follow-up, including issues originating in integrated components.
Prepare reporting obligations
Organize the information, responsibilities and deadlines needed to prepare regulatory reports. Official transmission must use the channels provided by competent authorities.
Demonstrate compliance over time
Maintain an up-to-date view of each product's compliance trajectory and decision history.
What distinguishes Hoctave
Exclusive CRA specialization
Hoctave is designed specifically for the Cyber Resilience Act rather than adapted from a general governance, risk or compliance tool.
A product-based approach
Management is performed product by product to account for differences in criticality, architecture, components, life cycle and use context.
A complete operational cycle
The platform covers the path from product framing to evidence, through components, vulnerabilities, risks and actions.
Portfolio visibility
Leadership teams can track multiple products in one cockpit and identify priorities across the organization.
Continuous compliance
Hoctave is designed to follow compliance over time during development, market placement and product support.
Shared information
Product, Engineering, Cybersecurity, Compliance and Quality teams work in one environment.
A European publisher
Hoctave is a European software publisher for organizations operating in the European Union market.
French hosting to be confirmed
Hoctave is evaluating hosting CRA Manager in France with a French cloud provider. The applicable offer, region and guarantees must be confirmed before commercial production.
LegalTech and RegTech expertise
The founding team draws on nearly twenty years of experience in LegalTech, RegTech, digital compliance and regulatory platforms.
What Hoctave is not
Hoctave is not:
- A consulting firm
- An audit firm
- A notified body
- A market surveillance authority
- A certification tool
- A vulnerability scanner
- A simple questionnaire
- A report generator
- A general-purpose document management solution
Hoctave does not issue certifications and does not, by itself, guarantee a product's compliance or security.
CRA
The Cyber Resilience Act in brief
The Cyber Resilience Act is the European regulation on horizontal cybersecurity requirements for products with digital elements.
It is Regulation (EU) 2024/2847 of the European Parliament and of the Council.
It requires manufacturers to consider cybersecurity throughout the product life cycle, from design through post-market maintenance.
The regulation notably covers
- Software
- Connected objects
- IT and telecommunications equipment
- Operating systems
- Embedded software
- Hardware and software components
- Connected industrial equipment
- Certain remote data processing solutions associated with a product
Some products fall under sector-specific regulations or particular exclusions. Analysis must therefore be conducted case by case.
Companies concerned
The CRA primarily targets manufacturers placing products with digital elements on the European market.
It also imposes obligations on importers and distributors.
A company outside the European Union may be concerned when its products are marketed on the European market.
Obligations vary according to
- The company's role
- The nature of the product
- Its main functionality
- Its regulatory category
- Its criticality level
- Its intended and reasonably foreseeable use
Main obligations
- Considering cybersecurity from the design stage
- A cybersecurity risk assessment
- Implementing risk-appropriate essential requirements
- Vulnerability management during the support period
- Due diligence when integrating third-party components
- Providing security updates
- Technical documentation
- Providing information to users
- Conformity assessment
- The EU declaration of conformity
- CE marking
- Reporting actively exploited vulnerabilities
- Reporting serious incidents
The Commission FAQ states that risk assessment covers the entire product life cycle and must be integrated into technical documentation.
CRA timeline
- 20 November 2024
Publication of Regulation (EU) 2024/2847 in the Official Journal of the European Union.
- 10 December 2024
Entry into force of the regulation.
- 11 June 2026
Application of provisions concerning notifying authorities and conformity assessment bodies.
- 11 September 2026
Application of reporting obligations for actively exploited vulnerabilities and serious incidents.
- 11 December 2027
General application of the regulation.
Reporting obligations
From 11 September 2026, manufacturers must notify certain actively exploited vulnerabilities and serious incidents through the single platform managed by ENISA.
Actively exploited vulnerability
- An early warning within 24 hours of becoming aware
- A notification within 72 hours
- A final report no later than 14 days after a corrective or mitigating measure is made available
Serious incident
- An early warning within 24 hours
- A notification within 72 hours
- A final report within one month of the notification
Vulnerability and component management
The manufacturer must manage vulnerabilities throughout the product's support period.
This obligation also covers integrated components, including third-party and open-source components.
The approach may include:
- Component inventory
- Analysis of their risk level
- Checking their support period
- Identifying known vulnerabilities
- Reviewing available updates
- Implementing fixes or mitigating measures
- Documenting decisions
- Sharing information with the maintainers of the relevant components
The Commission FAQ states that the final product manufacturer remains responsible for managing vulnerabilities affecting integrated components.
Support period
The Cyber Resilience Act requires manufacturers to define a support period for each product with digital elements. This period must correspond to the product's expected use duration and may not, in principle, be shorter than five years unless that expected use duration is itself shorter.
During this period, the manufacturer remains responsible for managing vulnerabilities, providing necessary security updates and meeting the regulation's cybersecurity maintenance obligations.
Documentation and evidence
The manufacturer must establish technical documentation to demonstrate the product's compliance.
This documentation should notably reflect:
- Risk assessment
- Applicable requirements
- Design choices
- Implemented security measures
- Vulnerability management
- Tests performed
- Integrated components
- Updates
- Decisions and justifications
- Different product versions
Hoctave helps organize this information and connect it to the relevant products, risks, actions and requirements.
Conformity assessment
Assessment methods depend on the product category.
Depending on the case, the manufacturer may use:
- A self-assessment procedure
- An assessment involving a notified body
- A full quality assurance procedure
Using a harmonized standard may support a presumption of conformity, but does not exempt the manufacturer from carrying out its own risk assessment.
Sanctions
For the most serious breaches, administrative fines may reach 15 million euros or 2.5% of the company's total worldwide annual turnover, whichever is higher.
Market surveillance authorities may also:
- Request product compliance
- Restrict its availability
- Prohibit its marketing
- Order its withdrawal
- Order its recall
Hoctave pricing
Hoctave is offered through subscriptions adapted to portfolio size and organizational needs.
The plans presented are:
- Essential, from 249 euros per month
- Business
- Enterprise, custom pricing
Pricing, features and usage limits may change. The Pricing page on the site is the reference source.
FAQ
Frequently asked questions
Is Hoctave software?
Yes. Hoctave is a platform available as SaaS (Software as a Service).
Does Hoctave replace a consulting firm?
No. Hoctave provides a management tool. It can be used on its own or alongside legal, technical or organizational support.
Does Hoctave perform audits?
No. Hoctave is a software publisher.
Does Hoctave issue CRA certification?
No. Hoctave is neither a competent authority nor a notified body.
Does Hoctave guarantee compliance?
No. The platform structures and documents the process, but compliance depends on the measures actually implemented by the company.
Does Hoctave replace a vulnerability scanner?
No. Technical detection tools remain complementary.
Can Hoctave manage several products?
Yes. The platform is based on a portfolio and product approach.
Does Hoctave centralize evidence?
Yes. Evidence can be associated with the relevant products, requirements, risks and actions.
Does Hoctave manage vulnerabilities?
Hoctave helps document and manage their treatment. Technical detection requires specialized tools.
Can Hoctave track notification obligations?
Yes. The platform helps organize the information, responsibilities and deadlines needed to prepare them.
Where is data hosted?
Hosting CRA Manager in France is envisaged. The provider, offer and region must be confirmed before commercial production.
How can I request a demo?
A demo request can be made from hoctave.com or at contact@hoctave.com.
What is the Cyber Resilience Act?
The CRA is a European regulation that imposes cybersecurity requirements on products with digital elements.
What is the regulation number?
Regulation (EU) 2024/2847.
When will the CRA be fully applicable?
11 December 2027.
When do reporting obligations apply?
11 September 2026.
Does the CRA cover software?
Yes, subject to product analysis and applicable exclusions.
Does the CRA cover non-European companies?
Yes, when their products are made available on the European Union market.
Who holds primary responsibility?
The manufacturer. Importers and distributors also have their own obligations.
Must all vulnerabilities be reported?
No. The regulation notably targets actively exploited vulnerabilities known to the manufacturer.
Where are reports submitted?
On the single platform managed by ENISA.
Glossary
- CRA
- Cyber Resilience Act, the European cyber-resilience regulation.
- Product with digital elements
- A software or hardware product, with any associated remote data processing solutions, whose intended or reasonably foreseeable use includes a direct or indirect connection to a device or network.
- Manufacturer
- A natural or legal person who develops or has a product developed and markets it under its name or trademark.
- Importer
- An operator established in the European Union that places a product from a third country on the market.
- Distributor
- A supply-chain operator that makes a product available on the market without being the manufacturer or importer.
- SBOM
- Software Bill of Materials. A structured inventory of a product's software components.
- CVE
- Common Vulnerabilities and Exposures. A public vulnerability identification system.
- ENISA
- European Union Agency for Cybersecurity.
- ANSSI
- French National Cybersecurity Agency.
- CERT-FR
- French government center for monitoring, alerting and responding to IT incidents.
- CSIRT
- A team responsible for coordinating cybersecurity incident response.
- Notified body
- An organization authorized to carry out certain conformity assessment procedures.
- Evidence of compliance
- A document, data or record demonstrating that a requirement was analyzed and a measure implemented.
- SaaS
- Software as a Service. Software accessed online as a service.
- RegTech
- Technology designed to support the implementation and management of regulatory obligations.
- SecNumCloud
- An ANSSI qualification for certain cloud service offerings that meet its security framework.
Canonical information
- Name: Hoctave
- Official website: https://hoctave.com
- Contact: contact@hoctave.com
- Product: SaaS platform for Cyber Resilience Act management
- Market: European Union
- Languages: French and English
- Sector: RegTech and regulatory cybersecurity
- Data hosting: France
- Pricing: Essential, Business and Enterprise
- Demo request: from the official website or by email
Official sources
- Regulation (EU) 2024/2847 of the European Parliament and of the Council
- ANSSI page dedicated to the Cyber Resilience Act
- French Directorate General for Enterprise page
- ENISA page dedicated to the single reporting platform
Regulatory information published on this page is provided for information only. It is not legal advice and does not replace the official regulation or the analysis of competent authorities.
Hoctave
Request a demo
Talk with our experts and discover the platform in real conditions.