One-off purchase
€149
Report and core workspace access
One-time report purchase with 30 days of core workspace access. The monthly workspace subscription is separate.
Start with the free checkCyber Resilience Act · Regulation (EU) 2024/2847
One product record for your CRA work.
Bring your assessment, working plan, evidence and component monitoring into one product workspace — one that a single responsible person can keep up.
No signup. No email required to see your result.
Start with the free scope check. The report purchase includes 30 days of core workspace access; ongoing monitoring requires a separate subscription.
Fictional example · Workspace demonstration
Harborlight Sentinel
Workspace demonstration · Fictional example
Actively exploited vulnerability in a component you ship
DEMO-CVE-001 · fictional-demo-package
Example early warning due in
23h 35m 06sPlan
In progressVulnerability handling processAssociated working record
vulnerability-process.pdfExample attachment · supplied by AlexAdvisory match
DEMO-OSV-001Example OSV recordMake the next step concrete
- Responsible person
- Alex
- Planning target
- 30 Oct 2026
- Reported state
- In progress
Planning targets are your own dates. The original assessment remains preserved.
Stored legal dates
11 September 2026Reporting duty start
11 December 2027Full compliance
Illustrative workspace views and fictional records. Recording work does not independently verify compliance.
Reporting clock
An exploited-component alert opens the incident-recording workflow. You submit authority notifications yourself.
Your targets
Keep owners, planning dates and reported progress beside each obligation.
Stored legal dates
The assessment’s dates stay separate from the planning targets your team chooses.
Made for the person who owns it.
For technical founders, CTOs and engineering leads at small software companies shipping installed, mobile or self-hosted software to EU customers. Most arrive with something already on their desk.
A customer sent a security questionnaire
Answer from one record of your classification, recorded process states and evidence.
A release is coming up
See the obligations identified in your assessment, and who is working on each.
Someone asked for an SBOM
Upload a CycloneDX file and inspect its components and advisory matches.
No vulnerability process yet
Start from the plan: a responsible person, a planning date and working notes.
Keep your product’s CRA work moving.
Bring your assessment, working plan, evidence and component monitoring into one product workspace.
A place for the work that follows your assessment
Organise the next steps
Keep responsible people, planning dates and your reported progress with the work they relate to.
Keep supporting records together
Connect files, references and working notes to the relevant obligation.
Monitor your components
Import an SBOM and inspect advisory matches, their sources and monitoring coverage. Scheduled advisory monitoring requires a subscription.
Your assessment becomes a working plan.
Each step adds to the same product record. The original assessment remains preserved.
See the workspace you can use to organise the next steps for your product.
Regulation (EU) 2024/2847
Assessment
Important product, class I
Annex III, Class I, point 17
Classification, answer-by-answer reasoning, identified obligations, source references and applicable dates.
Original preserved
No signup. No email required to see your result.
Indicative classification, not legal advice
CRA-2024/2847 + Commission guidance 2026-03 — ruleset 0.2, Annex III/IV verified
Illustrative workspace views and fictional records. Recording work does not independently verify compliance.
01
Start the check
10 questions about what your product does and where you sell it. You get an indicative classification, the article it rests on, and the dates that follow from it.
02
An editable working plan
Record the current state of each identified obligation, assign an owner and choose a planning date. Keep your own targets separate from the dates in the assessment.
Fictional records shown. Progress is self-reported, not independently verified compliance.
03
Evidence and document drafts
Attach files or references to obligation records, and work on technical documentation and declaration drafts in the workspace. Your team supplies and checks the contents.
04
SBOM monitoring and incident records
During active workspace access, upload an SBOM, view matches against the loaded vulnerability sources, and record incident work. Matching is not exhaustive; you submit any authority notifications yourself.
Scheduled advisory monitoring requires a subscription.
05
Share where things stand
Choose which records a public status page shares, so a customer asking about your product has one place to look.
Public status sharing requires a separate active subscription.
06
A record you can return to
The purchased assessment is preserved alongside later workspace records. View the audit trail and export it when you need a record of changes.
Download the action matrix as CSV and the working snapshot as JSON. Evidence references are included; uploaded files are downloaded separately.
See the work ahead
Keep identified obligations and their source references together.
Make the plan yours
Record your own progress, assign owners and set planning dates.
Keep the context
Add working notes and connect evidence to the relevant obligation.
Fictional records shown. Progress is self-reported, not independently verified compliance.
Core workspace access is included for 30 days. A subscription is separate and does not start automatically.
Explore a sample reportHow it works
01
Start the check
02
Read the recorded result
03
Organize your records
One place instead of five.
Small teams often spread this work across a spreadsheet, a wiki, tickets and a shared drive. Scopeward keeps it as one record per product, so one person can maintain it.
- Obligations spreadsheet
- Disclosure policy wiki
- Vulnerability tickets
- Evidence folder
- SBOM in a CI artefact
- Plan
- Documents
- Vulnerability reports
- Evidence
- SBOM and monitoring
Subscription feature · fictional example
See what needs attention.
An OSV advisory match connects a component and version in your SBOM to an advisory record.
OSV advisories
OSV advisory matches are based on package URLs from the uploaded SBOM and do not mean that a vulnerability is actively exploited.
OSV matching uses locally imported ecosystem catalogues. Component identifiers are not sent to OSV.
DEMO-OSV-001 · fictional-demo-package · 1.2.0
Product assessment: Not recorded
Fictional advisory and package shown. A match does not establish exploitability in your product or active exploitation.
Fictional advisory and package shown. A match does not establish exploitability in your product or active exploitation.
Scheduled OSV advisory monitoring requires a separate paid subscription; it is not included in the 30-day core workspace access.
What the result rests on
Same answers, same result. Follow the recorded reasoning back to its sources.
01Answer
02Rule
03Source
04Indicative result
Rule-based
The same answers and ruleset produce the same classification every time.
Traceable
The report records answer-by-answer reasoning and the sources behind the result.
Versioned
Each assessment records its ruleset. Changes are listed in the source changelog.
The package is fully self-serve. No person reviews your assessment or documents. It does not certify compliance or provide legal advice.
What stays with you
Process states, owners, planning dates, notes and evidence. These entries organise your work; they do not independently verify compliance.
See what your purchase opens
The report brings together your assessment and your working records. Explore a fictional example before deciding whether the package fits your team.
Generated from your assessment
Classification, answer-by-answer reasoning, identified obligations, source references and applicable dates.
Recorded by your team
Process states, owners, planning dates, notes and evidence. These entries organise your work; they do not independently verify compliance.
01
A report you can share
Read the assessment alongside its recorded answers and sources. Open document mode to print it or save it as a PDF.
02
An editable working plan
Record the current state of each identified obligation, assign an owner and choose a planning date. Keep your own targets separate from the dates in the assessment.
03
Exports for your existing tools
Download the action matrix as CSV and the working snapshot as JSON. Evidence references are included; uploaded files are downloaded separately.
04
Evidence and document drafts
Attach files or references to obligation records, and work on technical documentation and declaration drafts in the workspace. Your team supplies and checks the contents.
05
SBOM monitoring and incident records
During active workspace access, upload an SBOM, view matches against the loaded vulnerability sources, and record incident work. Matching is not exhaustive; you submit any authority notifications yourself.
06
A record you can return to
The purchased assessment is preserved alongside later workspace records. View the audit trail and export it when you need a record of changes.
Exactly what is included
| Report and portability — retained after included access |
|
|---|---|
| Core workspace — included for 30 days |
|
| Requires a separate active subscription |
|
After the included period, your purchased report, records and exports remain available read-only until deletion or service closure. Editing and active monitoring require a separate subscription. A report purchase does not start recurring billing.
What happens after purchase
Day 0
On purchase
Your report and product workspace open with the stored assessment. Any current-state entries saved before checkout carry into the working plan.
Days 1–30
For the first 30 days
Core workspace access is included: edit the plan, add evidence, use the document tools and set up monitoring.
Day 31+
After 30 days
The report and records remain available read-only, with exports. A separate workspace subscription restores editing, reminders and monitoring; it does not start automatically.
The package is fully self-serve. No person reviews your assessment or documents. It does not certify compliance or provide legal advice.
Access and pricing
Optional, separate
€49per month
Workspace subscription
Core workspace access is included for 30 days. A subscription is separate and does not start automatically.
See what is includedWhat the Cyber Resilience Act is
Regulation
Regulation (EU) 2024/2847
Scope check
10 questions about what your product does and where you sell it. You get an indicative classification, the article it rests on, and the dates that follow from it.
Ruleset
Article 14 reporting obligations apply from 11 September 2026. The Regulation generally applies from 11 December 2027, subject to transitional provisions.
Before you start
Do I need an account for the free check?
No signup. No email required to see your result.
What happens if the check cannot classify the product?
At least one of your answers leaves a point genuinely open, so no class is shown. Showing a class your answers do not support would be worse than showing none.
What is included with the readiness report?
- Obligation checklist
- 24h / 72h reporting runbook
- Documentation templates
- Compliance workspace access
Is this legal advice?
Indicative classification, not legal advice
Does the report purchase start a subscription?
After the included period, your purchased report, records and exports remain available read-only until deletion or service closure. Editing and active monitoring require a separate subscription. A report purchase does not start recurring billing.