Cyber Resilience Act preparation for software and device manufacturers.

Know before the clock starts.

Under the EU Cyber Resilience Act, manufacturers have 24 hours to give an early warning of an actively exploited vulnerability in their product. Fristal matches your components against known vulnerabilities every day, starts a timed reporting checklist when you confirm one is being exploited, and pre-fills the report fields for your team to review and submit.

Check if the CRA applies to you (free, no signup) See plans from £29 a month

Daily matching against OSV.dev and the CISA Known Exploited Vulnerabilities catalogue. CycloneDX SBOMs and a timestamped evidence log. You submit reports to ENISA yourself; we help you prepare.

Why now

Reporting duties have applied since 11 September 2026. Here is what they require.

You can't report on a vulnerability you haven't spotted, in a component you haven't listed.
  • If you make software, firmware or a connected device and sell it in the EU, the CRA probably applies to you. That includes UK companies. It doesn't matter where you're based.
  • Since 11 September 2026, manufacturers must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a fuller notification within 72 hours, and a final report within 14 days of a corrective or mitigating measure being available.
  • Most of the rest of the Act applies from 11 December 2027.
  • The process needs an owner and a record: when the vulnerability was found, who confirmed it was being exploited, who completed each step, and who marked each report as submitted, with times. Fristal keeps that record.

How it works

Three steps, then a daily watch.

  1. Add your product and your dependencies.

    Upload a lockfile (npm, pip, Cargo, Go and more) or drop in an SBOM you already have. We ingest it and keep a CycloneDX SBOM for you.

  2. We watch it every day.

    Every component is matched daily against OSV.dev and the CISA KEV catalogue. New vulnerability in something you ship? You get an email (and, on Team, a team alert) with what's affected and whether it's on the exploited list.

  3. If it's being exploited, the clock starts.

    Mark a vulnerability as "actively exploited in our product" and Fristal starts a timed checklist: 24-hour early warning, 72-hour notification, final report within 14 days of a corrective or mitigating measure. Report fields are pre-filled. Export a printable page (save it as PDF) or JSON, then submit through ENISA's single reporting platform.

    Fristal can't submit reports for you. Only you can, as the manufacturer.

Features

What you get

CycloneDX SBOM per product

Upload a lockfile or an existing SBOM. We produce a CycloneDX SBOM you can download any time.

Daily vulnerability matching

OSV.dev for known vulnerabilities, CISA KEV for ones known to be exploited. Checked every day, so nobody has to remember to look.

Alerts that reach people

Email on every plan; team alerts on Team so it doesn't depend on one person's inbox.

The reporting clock

Timed 24h / 72h / 14-day checklist with who did what and when.

Pre-filled report fields, exported

Printable page and JSON, ready to copy into ENISA's platform. You review, you submit.

Support period and end-of-life tracker

Record how long you'll support each product and get warned before it runs out.

Evidence log

A timestamped record of scans, decisions and reports, so "what did we know and when?" has an answer.

Try the free SBOM scan (no signup): a summary of known vulnerabilities in a lockfile or SBOM.

What we don't do: we don't submit reports for you, give legal advice, or certify anything. We help you prepare.

What we cover: actively exploited vulnerabilities only. Fristal does not handle severe-incident reports (Art. 14(3)–(5) of the Act), which have their own notifications and a one-month final report. If you have a severe incident, handle that separately.

Pricing

Plain pricing, in pounds, per month.

Start free with the checker and scan. Cancel any time.

Free checker

Price: £0

Who it's for: Finding out where you stand

Check my product

Products n/a

  • "Am I in scope?" checker
  • Quick SBOM scan (no signup)
  • Not included: Saved SBOM per product (CycloneDX)
  • Not included: Daily OSV.dev + CISA KEV matching
  • Not included: Email alerts
  • Not included: Team alerts (Slack)
  • Not included: 24h / 72h / 14-day reporting checklist, printable and JSON export
  • Not included: Support-period / end-of-life tracker
  • Not included: Evidence log (CSV export)

Solo

Price: £29 / month

Who it's for: One product

Start with Solo

Products 1

  • "Am I in scope?" checker
  • Quick SBOM scan (no signup)
  • Saved SBOM per product (CycloneDX)
  • Daily OSV.dev + CISA KEV matching
  • Email alerts
  • Not included: Team alerts (Slack)
  • 24h / 72h / 14-day reporting checklist, printable and JSON export
  • Support-period / end-of-life tracker
  • Evidence log (CSV export)

Team Includes team alerts

Price: £79 / month

Who it's for: Several products, shared team alerts

Start with Team

Products Up to 5

  • "Am I in scope?" checker
  • Quick SBOM scan (no signup)
  • Saved SBOM per product (CycloneDX)
  • Daily OSV.dev + CISA KEV matching
  • Email alerts
  • Team alerts (Slack)
  • 24h / 72h / 14-day reporting checklist, printable and JSON export
  • Support-period / end-of-life tracker
  • Evidence log (CSV export)

Evidence

Price: £199 / month

Who it's for: When a customer or auditor asks for paperwork

Start with Evidence

Products Up to 5

  • "Am I in scope?" checker
  • Quick SBOM scan (no signup)
  • Saved SBOM per product (CycloneDX)
  • Daily OSV.dev + CISA KEV matching
  • Email alerts
  • Team alerts (Slack)
  • 24h / 72h / 14-day reporting checklist, printable and JSON export
  • Support-period / end-of-life tracker
  • Evidence log (CSV export)

Prices are per month in pounds sterling. We're not VAT registered, so no VAT is added. Cancel any time. Fristal helps you prepare; it doesn't certify your product or guarantee compliance.

FAQ

Questions people ask

Does the CRA apply to me?

Possibly. Use the free checker, which takes about two minutes. It covers the Act's scope rules, but it's a guide, not a ruling.

Is this legal advice?

No. Fristal is a software tool that helps you organise information and prepare for CRA duties. We're not a law firm, and nothing in the product or on this site is legal advice. If your product is in a grey area (a medical device, an open-source project with a commercial side, anything in the Act's "important" or "critical" product lists), talk to a qualified lawyer.

Can you submit the report for me?

No. Under the CRA the manufacturer reports, through ENISA's single reporting platform. We can't and don't submit anything on your behalf. What we do is start the clock, keep the checklist, pre-fill the report fields and export them, so whoever submits starts from a complete draft.

Does the CRA apply to me if I'm UK-based?

It can. The Act applies to products with digital elements made available on the EU market, wherever the manufacturer is based. If you sell, ship or distribute software or connected devices to people or businesses in the EU, it's likely to apply to you, even after Brexit. If you only sell in the UK, it doesn't apply to those sales, though UK product-security rules (the PSTI regime) may. Check the free tool; if it's unclear, ask a lawyer.

What counts as "actively exploited"?

That's your judgement as the manufacturer, based on evidence that someone is using the vulnerability against real systems. A CISA KEV listing is a strong signal, but being on the list doesn't automatically mean it's being exploited in your product, and it's up to you to decide. Fristal flags it and starts the clock when you confirm.

Where does the vulnerability data come from?

OSV.dev and CISA's Known Exploited Vulnerabilities catalogue, both public. No scanning tool catches everything; matches depend on how well your dependencies are identified.

Does it look at my source code?

No. We use your lockfile or SBOM: the list of components, not your code.

Is my data safe?

We read the component list from your lockfile or SBOM, not your source code. When you upload to a product we also keep the original file in a private storage bucket hosted by Railway in the EU (Amsterdam). It has no public links, it is stored under a random name kept separate for each organisation and product, and only users in your organisation can download it, through the app. Each download is recorded in your evidence log. The free checker and quick scan keep none of your answers or files. Passwords are stored as argon2id hashes, sessions use signed HttpOnly cookies, and forms are protected against cross-site request forgery. More detail, including who processes your data, is in our privacy notice.

I'm an open-source maintainer. Is this for me?

The CRA treats free and open-source software supplied outside a commercial activity differently from commercial products. The scope checker explains the main points. If you sell support, charge for a hosted or paid version, or the project is tied to your business, you may be inside it.

What if I only run a SaaS?

The Act covers products with digital elements and their remote data processing solutions, not a pure online service on its own. The checker asks about this; if you're unsure, take legal advice.

Can I cancel?

Yes, any time, from your account.

Find out where you stand in two minutes.

Free, no signup. A guide to the Act's scope, not legal advice.

Am I in scope?