Copla Launches Framework for EU Cyber Resilience Act Compliance

Copla has launched a framework on its compliance platform for the EU Cyber Resilience Act, giving manufacturers a task-level route to meet rules that bar non-compliant products from the EU market from December 11, 2027.

The framework matters now because Cyber Resilience Act compliance is no longer a future project. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since September 11, 2026, and the penalty for breaching core security rules reaches €15 million or 2.5% of global annual turnover, whichever is higher.

What the Cyber Resilience Act compliance framework contains

Copla’s framework splits the secure-by-design and vulnerability-handling obligations of the CRA into discrete tasks. It sets out a preparedness plan and supplies templates for the technical documentation and for the EU Declaration of Conformity.

It joins the frameworks already on the platform for DORA, NIS2, ISO 27001, SOC 2 and PCI DSS. Copla also lists GDPR, UK GDPR, the EU AI Act, MiCA and NIST among the 50-plus frameworks on its website.

For a compliance team, the practical effect is a single place to assign each CRA duty to an owner and a control, and to keep the evidence a market surveillance authority could ask for. Teams already running DORA or ISO 27001 programs on the same platform can reuse existing policies and evidence where requirements overlap.

Who Copla is and who buys from it

Copla is a Lithuanian compliance automation company. Its platform combines governance, risk and compliance tooling, third-party risk management, document management with AI-assisted policy drafting, an information security management system, a DORA Register of Information and incident reporting modules. It also sells CISO-as-a-service, managed vulnerability scanning and penetration testing.

Its customers are mainly financial institutions and technology companies in Europe. They include GF Bank, Saldobank, Fjord Bank, SMEbank, Republic, Coingate and the healthcare group Affidea. Copla raised €6 million to build out its compliance automation.

The CRA reaches beyond that base. It applies to any business that makes products with digital elements available in the EU, whether the product is an app, a platform or a connected device. Banks that build their own software or sell connected hardware fall inside it, as do their suppliers.

The Cyber Resilience Act timeline and penalties

The CRA, Regulation (EU) 2024/2847, entered into force on December 10, 2024. It applies in stages, set out in Article 71 of the text.

The reporting obligations in Article 14 started on September 11, 2026. Manufacturers must notify both the EU cybersecurity agency ENISA and the relevant national computer security incident response team (CSIRT) when a vulnerability is being actively exploited or a severe incident affects a product. The first step is an early warning within 24 hours of becoming aware, followed by a fuller notification within 72 hours.

The remaining obligations apply from December 11, 2027. From that date a product without a valid EU Declaration of Conformity and CE mark cannot lawfully be placed on the EU market. National market surveillance authorities can then require withdrawals or recalls.

The CRA extends the CE mark, familiar from toys, kettles and chargers, to software for the first time. Manufacturers must show that a product meets the security requirements, keep technical documentation, sign the declaration and only then affix the mark.

The financial penalties come on top of the market ban. Under Article 64, breaches of the essential cybersecurity requirements can draw fines of up to €15 million or 2.5% of worldwide annual turnover, whichever is greater. Breaches of other manufacturer obligations carry a ceiling of €10 million or 2%, and supplying incorrect information to authorities up to €5 million or 1%.

The five obligations Cyber Resilience Act compliance covers

The regulation sets five central duties:

• Products must be secure by design and by default.
• Manufacturers must handle vulnerabilities throughout the support period.
• Technical documentation must show how the security rules are met.
• A manufacturer must sign an EU Declaration of Conformity.
• Compliant products must carry the CE mark.

The regulation also sets duties for open-source software stewards under Article 24. Those duties are lighter than the manufacturer obligations.

The vulnerability-handling duty ties into existing vulnerability management programs, but it extends them. Manufacturers must track the components inside a product, fix flaws without delay and report exploited ones to authorities. That is why a software bill of materials (SBOM), a machine-readable list of a product’s components, sits at the center of most readiness plans.

Where readiness stands: the ENISA survey

ENISA’s first SME survey on the CRA, published on June 24, 2026, covered 194 organizations in 31 countries. It found that 66% of respondents knew of the regulation.

Practice lagged awareness. Only about one in three respondents used an SBOM. Incident response and product lifecycle management were the weakest capabilities for businesses of all sizes.

ENISA said participation was voluntary and the results should not be taken as representative of EU small and medium-sized enterprises. A voluntary sample probably leans toward firms already engaged with the issue, so actual readiness could be lower.

The weak spot is the one the law now tests. Incident response is the capability behind the 24-hour early warning that applies today.

Copla CEO and co-founder Aurimas Bakas tied the launch to those findings.

“ENISA’s findings show that awareness is there, but the practical groundwork often isn’t yet. An SBOM, a vulnerability handling process and an incident response plan take time to put in place properly, and the reporting obligations already apply today. Companies that start now still have a realistic window to get there before December 2027, and that’s what we want to help them do.”

Aurimas Bakas, CEO and co-founder, Copla

What Cyber Resilience Act compliance means for buyers

For financial institutions, the CRA adds a product-security layer to rules they already follow. DORA covers the operational resilience of the firm and its critical ICT suppliers. The CRA covers the security of the products those suppliers and the firm itself place on the market. The DORA requirements and the CRA will draw on the same evidence, from incident logs to vendor records.

Third-party risk teams may start asking suppliers of software and connected devices for their CRA position. A supplier that cannot affix the CE mark after December 11, 2027 cannot sell in the EU, which makes it a supply continuity risk. Board reporting on cyber resilience will need to cover product security as well as enterprise security. Teams can track each CRA duty in an obligations register with a named owner and a due date.

Copla is one of several vendors building CRA tooling, and product-security specialists and GRC platforms are adding the same checklists. The European Commission’s Cyber Resilience Act page and ENISA’s materials remain the reference for what the law requires, whichever tool a firm chooses.

What comes next

The next fixed date is December 11, 2027, when the full CRA obligations apply and products without a declaration of conformity and CE mark can no longer be placed on the EU market.