normakte / CRA software
normakte does not replace security testing. It organises what the CRA requires of the manufacturer – and documents that it has been done.
| Function | What it does |
|---|---|
| Requirements register | all 32 CRA requirements with article reference, status and justification |
| Classification | default, important (class I or II) or critical, with the matching procedure |
| SBOM | components per product, export as CycloneDX |
| Cyber risk assessment | threats, measures and mapping to Annex I |
| Reports under Art. 14 | awareness, early warning, notification, final report – with calculated deadlines |
| Support period and user information | target page behind a QR code with contact point, end of support and released documents |
| Versioned documents | every file with a SHA-256 checksum |
| Export | ZIP with register, SBOM, reports and documents – at any time, in open formats |
Not a vulnerability scanner and not a penetration test. That work stays with your developers or specialised providers; normakte records what was tested, what is open and which evidence belongs to which requirement.
From €49 per month per product file, cancellable monthly. Data in a data centre in Frankfurt am Main; access for your organisation only.
One trial file with all features is free until 20.01.2027.
Source. Regulation (EU) 2024/2847, OJ L, 2024/2847 of 20.11.2024. Summarised; only the official text is authoritative. normakte is not legal advice.