Know what is in your products and meet CRA reporting deadlines
The Cyber Resilience Act (CRA) requires manufacturers to report actively exploited vulnerabilities and severe incidents within 24 hours, 72 hours and 14 days – from 11 September 2026. Triconform keeps products, components, vulnerabilities and reports together.
What you keep in Triconform
Products and versions
A record of products and versions, product class and support period with a reminder before it ends.
SBOM made simple
Import CycloneDX or SPDX, upload from Excel, build one by hand from a catalogue of common components, or upload automatically from CI with a token. Your firmware supplier can upload an SBOM via a link, without an account.
Vulnerability monitoring
Components are continuously matched against the public sources NVD, OSV and CISA KEV, and against end-of-support data from endoflife.date.
What to fix
The “What to fix” screen ranks vulnerabilities by urgency and shows the recommended component version for each.
“Does it affect us?” and “Where do we use X?”
A vulnerability in a widely used library? One query shows which products and versions contain it.
Reports at 24 h / 72 h / 14 days
A deadline countdown and a prepared report draft. You submit the report via the ENISA platform; Triconform records what was submitted and when.
VEX for customers
Statements on whether a vulnerability affects a product, exported as CycloneDX VEX, OpenVEX or CSAF.
Technical documentation
Inputs for the technical documentation and the EU declaration of conformity. It is an input, not a declaration – the manufacturer signs that.
Manufacturer security page
A public page with supported products, a form for reporting vulnerabilities (coordinated vulnerability disclosure, CVD) and a security.txt template.
When a vulnerability appears in a product
Alert
For an actively exploited vulnerability we alert you immediately; others appear in the weekly summary.
Does it affect us?
You see which products and versions contain the component and the recommended fixed version.
Reporting
A 24 h, 72 h and 14-day countdown and a prepared draft for the ENISA platform.
Customer statement
VEX export and an update of the manufacturer security page.
Evidence
The whole process stays in the record with a timestamp, for customers and inspections.
What stays with you
- You submit the reports. The ENISA platform has no interface for automatic submission.
- The manufacturer signs the EU declaration of conformity. Triconform prepares the inputs.
- Vulnerability matching depends on a complete SBOM and on public databases. It is an aid, not a guarantee.
Try Triconform with your own data
30-day trial access free of charge, with no commitment. Write to us and we will set up your access within 2 working days – or book a short demo first.