Frequently asked questions

Short, direct answers. For the long version of the September deadline, see the article; for a scope verdict on your own product, run the classifier - it cites the article of the regulation behind every answer.

What does CRA Desk actually do?

It watches your components against vulnerability advisories, flags which ones are CRA-reportable, and drafts the Article 14 report against a deadline timer computed from the regulation itself. When your users need to hear about a vulnerability it works out which versions are affected and builds the Article 14(8) advisory, and each month it closes an evidence report of what it watched. It also generates the artefacts Annex I asks for: an SBOM per product version, a CVD policy and security.txt and an Annex VII technical-documentation skeleton.

Is CRA Desk a vulnerability scanner?

It runs SCA-style matching underneath - OSV advisories, CISA KEV - but that matching is an input, not the product. A generic scanner stops at a CVE list. CRA Desk's job starts there: the 24h/72h/ 14-day timers Article 14 sets, a draft report per stage and a human who files it.

Does the CRA apply to me if I only ship a hosted service?

Generally no. Article 3(2) scopes the regulation to a product's own "remote data processing solutions" - software that runs on someone else's device is in, a browser-only web app usually isn't. This is a per-product question, not a company-wide one, so run the classifier against your actual product rather than relying on a rule of thumb.

What's matched against vulnerabilities and what isn't?

Matching runs on OSV advisories across the language ecosystems and Alpine system packages, with CISA KEV and EU KEV each supplying the "actively exploited" flag. NVD only adds a CVSS score to a match that already exists - it never finds one on its own. Debian and Ubuntu packages, images built on them and components with no package URL aren't matched at all. The full boundary is on the coverage page.

Where does the "actively exploited" flag come from?

From two catalogues, each read on its own: CISA's Known Exploited Vulnerabilities list and ENISA's EU KEV. A listing in either raises the flag on a match you already have, and the date of each listing is kept per source. The flag never creates a match - a vulnerability that doesn't touch your components stays out of your alerts, however widely it is exploited. A listing is evidence of exploitation (Article 3(42)), not the definition of "actively exploited", and not being listed is not evidence that a vulnerability isn't being exploited.

What happens if a vulnerability source goes down?

The panel says so, naming the source and the date it went quiet. Matches already found stay valid; only the detection of new ones from that source pauses until it recovers. Read a silent source as unknown, never as "no vulnerabilities" - an empty alert list proves nothing while a source is down. Each source's availability for the month is also in the monthly evidence report, so a gap is on record rather than discovered later.

What happens when I stop supporting a product version?

You decommission it in the panel, version by version. From then on CRA Desk no longer watches that version: no new matches, no alerts, and an upload under its label is refused. Matches that stop affecting any version you still watch are retired rather than deleted, and the panel can show them. Decommissioning changes what CRA Desk watches, not what the regulation requires of you; CRA Desk does not track support periods or decide when a version stops being supported, so that call stays yours. What is not watched is listed on the coverage page.

When does the 24-hour clock start?

Article 14 counts from the moment you become aware. CRA Desk records that moment as the anchor of the case, and by default it is when the alert was delivered to you. If you became aware earlier or later, change the anchor to when the match was detected or to a time you enter, with a reason. The dates that bear on it - alert delivered, match detected, each KEV listing - are kept next to it as evidence, and every change is added to a history that can't be edited or removed.

How do I notify my users under Article 14(8)?

Open the case and use Notify users (Team plan). From your own SBOM history, CRA Desk proposes which of your product versions are affected - each one affected, not affected or not checked, and a version with no SBOM behind it is never reported as safe. You review the proposal, and one CSAF 2.0 advisory plus a readable version are built from what you approved, with a revision history. CRA Desk does not send anything: you publish or send the advisory yourself and record it in a dispatch log whose entries can't be edited afterwards.

What can I hand to an auditor?

A monthly evidence report for each closed calendar month, as Markdown and JSON: the components observed, the advisories assessed, the VEX assertions your team made and who made them, the needs-review queue and how available each vulnerability source was. A report is closed once and kept as it was, never recalculated. It is in the panel on every plan and, from Starter, by e-mail. What the product doesn't measure yet - release support status today - is named as not measured. The report records what was observed and how well, not that an obligation was met; whether an auditor accepts it is the auditor's call.

What is VEX and why does it matter?

Dismissing a false match records the reason in the OpenVEX format, not just a status flip. If an auditor or a customer later asks why a match doesn't count, you have a standard, portable artifact instead of a memory.

Can I connect an AI agent to CRA Desk?

Yes, on Team and Enterprise, through a Model Context Protocol (MCP) server. A read-only token, the default, lets an agent look at your products, vulnerabilities, cases and documents. A read and write token also lets it file requests to change data, but a request does nothing until a person approves it in the panel, on a screen that shows what approving would do. An agent cannot approve its own request, and nothing is ever filed with ENISA or a CSIRT by an agent or by CRA Desk. What an agent reads goes to the model provider you connected it to, which is why the component inventory is a separate opt-in scope. The server takes a bearer token rather than OAuth, so connectors that only offer an OAuth sign-in cannot connect yet. The details are on the MCP page.

How much does it cost?

Free covers one product, an in-panel SBOM and the CVD policy/security.txt generators, with no monitoring. Starter and Team are self-serve at fixed EUR prices; Enterprise is invoiced on contract terms. No paid tier is gated behind a sales call.

Where is data hosted?

AWS Ireland, with a DPA available on request and EU invoicing.

Do you hold yourself to the same rules you sell?

Yes. Our own security.txt and CVD policy are generated by this product - see the live page.

Does CRA Desk replace a notified body or a lawyer?

No. Class II and Annex IV products still need a notified body for the 2027 conformity assessment, and nothing here is legal advice. CRA Desk covers the Article 14 reporting workflow and the technical-documentation skeleton the regulation asks for - not certification.

Can I trust the classifier's verdict?

It runs a versioned, rule-based ruleset in your browser - not a model guessing - and every verdict cites the article of the regulation it came from. Nothing you enter leaves the page.

This is a compliance aid, not legal advice. The obligations rest with the manufacturer.