Cyber Resilience Act · Technical Documentation
Technical file for the Cyber Resilience Act, built from your repository — not a questionnaire.
FactFile reads your source repository and build artifacts — dependency manifests, container images, release metadata — and generates your Annex VII technical file from what your software actually contains. Not from answers a person typed into a form.
See a real technical file belowRead from your build — not typed by hand
- ›package.json
- ›requirements.txt
- ›Dockerfile
- ›build.gradle.kts
- ›sbom.cdx.json
- ›Podfile.lock
→ Annex VII technical file, SBOM, risk assessment, DoC
Reads the resolved build, not a form
Parsing a build file by itself found 43 components on a real Android app. Actually resolving the dependency tree found 242 — including 10 whose version static parsing would have gotten wrong. An SBOM with the wrong version is worse than no SBOM: when a vulnerability notice comes in, you won't find yourself in it.
Checks both directions, not just one
Every risk must point to a real requirement, and every requirement must be covered by at least one risk — a requirement with zero risks means the analysis is incomplete. On the first real run this caught 7 requirements nobody had analyzed, all process obligations a code scan can't see on its own.
A complete package, not a skeleton
Technical file, SBOM, risk assessment, and declaration of conformity — delivered as finished documents, not a template with blanks left for you to fill in.
Two ways to work with us
A subscription we're building, and a pilot we deliver today
Automated technical-file generation, kept in sync with every release. Run it in CI and get updated Annex VII evidence on every build, instead of redoing paperwork by hand each time you ship.
Note —This is an early-access list, not a purchase. No charge today. We'll email you when self-serve access opens at this price.
No password, no account. One field, one email.
We hand-build the CRA evidence package for your product in 7 business days, from your actual repository — not a template.
Scope: one released product, one version, up to two repositories. See terms for the fixed clock-start conditions.
- ✓ Technical file — Annex VII
- ✓ SBOM (CycloneDX) — Annex I(II)(1)
- ✓ Risk assessment mapped to your dependencies — Art. 13(2)
- ✓ Declaration of Conformity — Annex V
- ✓ Known-vulnerability match report (OSV.dev) — supplementary
- ✓ Article 14 reporting runbook — supplementary
If we miss the 7-business-day deadline — counted from complete inputs, see terms — you get a full refund of the pilot fee.
We're building these by hand, one engagement at a time — we're taking the first three pilots, then pausing new pilots until that batch ships.
Available to businesses only (B2B) — the payment link requires a company name and VAT ID. Not sold to private individuals.
Questions worth asking
There are no harmonised standards yet — how can you promise compliance?
We can't, and anyone who says otherwise is overstating it. As of today, no harmonised standard under the Cyber Resilience Act has been published in the Official Journal of the EU, so the presumption-of-conformity route isn't available to anyone yet — not to us, not to a consultant, not to your own team. What FactFile produces is evidence: a technical file, an SBOM, a risk assessment, a declaration of conformity, built from your actual product. The compliance decision — and the responsibility for it — stays with you, the manufacturer, as the regulation requires.
Does my product even fall under the CRA?
In general: downloadable or installable software with digital elements is in scope. A pure SaaS product with no installable component generally is not. There are exceptions and edge cases on both sides, so treat this as a starting orientation, not a legal determination for your specific product.
Why is this better than hiring a consultant?
Price and speed. The pilot is €1,400 and 7 business days. A compliance consultant engagement for the same scope of documentation is typically a five-figure fee and a multi-week timeline — exact pricing varies by firm and we can't cite a single number as fact, but that's the general shape of it.