Ready for the Cyber Resilience Act
The CRA sets new security rules for software sold in the EU. Here is how the Accevo platform meets them, from incident reporting to security updates.
Security rules for the software running your factory
Regulation (EU) 2024/2847 makes software vendors responsible for security across the whole product lifecycle. Reporting of exploited vulnerabilities and severe incidents applies from 11 September 2026. All other CRA requirements, including CE marking, apply from 11 December 2027.
Vendors must handle vulnerabilities and ship security updates. For manufacturers, a supplier that can provide clear security evidence supports their own NIS2 audits.
How Accevo supports CRA readiness
Customers can report suspected vulnerabilities and incidents through the defined support channels.
Incident reporting
Customers report a security issue by email or Jira ticket.
Dedicated security team
Every report goes straight to the team that handles it.
Secure by design
We follow an ISO/IEC 27001 certified process to build security into development and operations.
Security updates
Security updates and vulnerability fixes are provided for supported software versions.
The numbers behind our security
3
ISO certifications
ISO/IEC 27001, ISO 22301 and ISO 9001, independently audited.
38+
Paesi
Manufacturers run Accevo across 38+ countries.
850+
Implementazioni
Factories that rely on the Accevo platform every shift.
Is the software running your factory ready for the CRA?
Ask us for our CRA and security documentation for your supplier assessment.
Already a customer? Report a security incident at [email protected].
Cyber Resilience Act - FAQ
The Cyber Resilience Act, Regulation (EU) 2024/2847, sets cybersecurity requirements for hardware and software products sold in the EU. It covers the whole product lifecycle: design, development, vulnerability handling and security updates.
The CRA entered into force on 10 December 2024. Reporting of exploited vulnerabilities and severe incidents applies from 11 September 2026. All other requirements, including CE marking, apply from 11 December 2027.
Yes. Standalone software sold in the EU counts as a product with digital elements. The obligations fall on the software manufacturer, so for the Accevo platform they fall on Accevo.
Vendors report actively exploited vulnerabilities and severe security incidents to the national CSIRT and ENISA. They send an early warning within 24 hours, a full notification within 72 hours and a final report afterwards.
The CRA regulates products. NIS2 regulates organisations in critical sectors, including manufacturing and food production. Under NIS2, plants must manage security risk in their supply chain, and a CRA-ready software vendor makes that easier to prove. Read how Accevo supports NIS2 on our compliance page.
Ask how the vendor handles and reports vulnerabilities, how long each version receives security updates, whether an SBOM is available and which certifications cover its development process.
Accevo customers report by email to [email protected] or by Jira ticket. Every report goes straight to our dedicated security team.