We generate the proof
What Finite State carries
Generates SBOM & VEX from what you ship
Runs the cybersecurity risk assessment
Monitors vulnerabilities continuously
Drafts disclosures & your CVD policy
Assembles technical docs & the DoC template
CRA compliance for device manufacturers
Turn CRA complianceinto a repeatable product-security program
The Cyber Resilience Act applies to any manufacturer placing products on the EU market, wherever the company is based. Finite State analyzes what actually shipped, maintains the evidence across every release, and assembles the technical file behind your Declaration.
How It Works
Turn Product Evidence
Into CRA Compliance
In March 2026, Quectel publicly stated its module portfolio supports CRA compliance ahead of the September deadline.
The CRA is written for regulators, not engineers
Nothing in the regulation tells you which requirements apply to your product, whether your existing scanner output counts as evidence, or what the technical file has to contain. Harmonised standards that would settle those questions have not been published yet. Meanwhile Article 14 reporting obligations started applying in September 2026, including to products already in the market.
- 01
Assess what actually shipped
The platform inventories every component in your binary, including supplier firmware that arrives with no manifest to read. Our team classifies the product, maps it against the essential requirements, names the gaps, and sequences them. For products already in market, we establish whether conformity is reachable through software updates or blocked by hardware.
- 02
Prioritize what is reachable
A CVE list with no product context sends engineers after code paths that cannot be reached in your device. The platform ranks findings by reachability and exploitability. Our product security team turns that into a risk assessment an assessor can follow.
- 03
Stay current after you ship
The platform checks new disclosures against your specific product and filters to weaponized vulnerabilities, giving your team a daily punch list. When something is actively exploited, our team drafts the notifications against the reporting clocks and coordinates with your PSIRT and communications teams.
What you receive, and what it satisfies
Every deliverable is generated from the product you ship and maintained across releases. Each maps to a specific CRA obligation.
DeliverableWhat it isCRA obligation
- Living SBOMWhat it isComponent inventory from delivered binaries, including third-party firmware. SPDX or CycloneDX. Regenerated on every release. No source code required.CRA obligationAnnex I Part II vulnerability handling, Annex VII technical documentation
- Cybersecurity risk assessmentWhat it isThreat modeling, control mapping, gaps, and remediation guidance, prioritized by whether the vulnerable code path is reachable in your device.CRA obligationAnnex I Part I essential cybersecurity requirements
- Supplier component reconciliationWhat it isSupplier-provided SBOMs checked against the binaries that actually arrived in your image, with evidence packages for supplier remediation.CRA obligationManufacturer due diligence on third-party components
- Technical documentation packageWhat it isThe technical file assembled from SBOM, risk assessment, implemented controls, & test evidence, with a declaration template, finalized through readiness review.CRA obligationAnnex VII technical documentation, Annex V declaration of conformity
- Vulnerability monitoring and disclosure workflowWhat it isProduct-specific correlation, VEX for what isn’t exploitable, draft notifications for each CRA deadline, and a disclosure policy. Submission stays yours.CRA obligationArticle 14 reporting, Article 13(6) coordinated vulnerability disclosure
Ownership + Scope
We Carry the Weight.You Keep Control.
You own the decision
What stays yours
Remediation & the Article 14 determination
ENISA / SRP filing
Signed Declaration of Conformity
Manufacturer accountability
What four years of this produces
Quectel Wireless Solutions has worked with Finite State since 2022, across a portfolio representing roughly 70% of North American IoT modules shipped in an 18-month window. In March 2026, Quectel publicly stated its module portfolio supports CRA compliance ahead of the September deadline. This is what four years of the work looks like, not what month one requires.
18 vs 98
Average risk score vs. industry, 10 = best
~95%
Of US-shipped modules with those scores since 2022
Top 10%
Of all connected products Finite State analyzed
“We started this work before any regulator asked us to, and that head start is why we can answer CRA questions today with documentation rather than promises.”
“When an enterprise customer asks us for an SBOM or penetration testing data, we can produce it.”
Planning Milestones
What each CRA deadline obligates you to do
Article 64 sets fines at up to 15 million euros or 2.5% of total worldwide annual turnover, whichever is higher. Market surveillance authorities can also require corrective action, restrict distribution, or order withdrawal. A product pulled from sale costs revenue on the day it happens.
Entered into force. The transition period starts.
Dec 10, 2024
Notified bodies can begin operating.
Jun 11, 2026
Article 14 reporting obligations apply. 24 hours for early warning, 72 for notification, 14 days for the final report. Applies to products already on the market.
Sep 11, 2026
Full application. Products without conformity cannot be placed on the EU market.
Dec 11, 2027
Questions
Map Your Product to the CRA
One product, one call. You leave knowing your class, your assessment route, and the deliverables that route requires. Map your product to the CRA.