The reporting obligations under the European Cyber Resilience Act will apply from 11 September 2026. As this deadline approaches, Hoctave is announcing the availability of CRA Manager, its SaaS software designed to manage compliance for products with digital elements.
The solution centralises the monitoring of products, vulnerabilities, risks, actions and compliance evidence. It is hosted in France on infrastructure qualified under the SecNumCloud scheme by the French National Cybersecurity Agency (ANSSI).
The Cyber Resilience Act enters its operational phase
Adopted on 23 October 2024 and in force since 10 December 2024, the Cyber Resilience Act is reaching a new milestone.
From 11 September 2026, manufacturers will be required to report actively exploited vulnerabilities and severe incidents affecting the security of their products with digital elements. The Regulation will apply in full from 11 December 2027.
Fifteen months separate these two deadlines. Organisations concerned should use this period to establish governance that connects requirements, decisions, corrective actions and compliance evidence.
Discussions held in recent months with product, cybersecurity and compliance teams point to a recurring issue. The necessary information is often spread across spreadsheets, ticketing tools, documents and email threads. The data exists, but its consolidation and traceability still need to be organised.
Shared monitoring of products, vulnerabilities and evidence
The Hoctave platform brings information currently distributed across several teams into a shared environment.
- Product portfolio: monitor each product’s compliance level and identify priority gaps.
- Vulnerabilities: collect, assess and prioritise vulnerabilities while maintaining traceability of decisions.
- Risks and action plans: manage corrective measures, responsibilities and deadlines.
- Compliance evidence: build and version files that can be used during an audit or regulatory inspection.
- Technical documentation: structure the materials required for conformity assessment and CE marking.
- Dashboards: provide a shared view for Product, Engineering, Cybersecurity, Legal and Compliance teams.
“The Cyber Resilience Act places traceability at the heart of the manufacturer’s responsibility. During an inspection, organisations will need to present dates, versions, decisions and the evidence supporting them,” explains Florian Graby, founder of Hoctave. “Our role is to make this information continuously available, from product design through to the end of its support period.”
Hosting suited to sensitive data
Information processed for compliance purposes can reveal a product’s composition, its vulnerabilities and the measures taken to remediate them. It directly concerns intellectual property and product portfolio security. Hoctave therefore chose hosting in France based on a cloud service qualified under ANSSI’s SecNumCloud scheme. This qualification meets enhanced technical, operational and legal requirements.
Organisations supported by Hoctave
Hoctave serves software publishers, manufacturers of connected devices and digital equipment, industrial groups, and organisations managing multiple products or entities within a shared compliance framework.
A partner programme is also available to consulting firms, integrators and cybersecurity providers wishing to structure and manage their clients’ Cyber Resilience Act compliance from a dedicated platform.
For a detailed overview of the requirements and deadlines, consult the practical Cyber Resilience Act guide.