exida has introduced exSILentia® CRA for manufacturers documenting product cybersecurity risks, giving companies a new assessment tool as European Union rules begin applying in stages before their general start in 2027. In a Nov. 3 announcement, exida said the software is available through its exSILentia platform.
The company describes the product as a structured workflow for threat analysis and risk assessment. It includes a risk matrix and predefined mitigations mapped from harmonized standards, and lets teams record identified risks and their responses. The product page also describes features for mapping requirements, assessing residual risk and preparing documentation for conformity activities.
The Cyber Resilience Act (CRA) requires manufacturers to assess cybersecurity risks linked to products with digital elements and include those assessments in technical documentation. Manufacturers must update assessments when appropriate. The regulation also calls for the assessment to account for a product’s intended purpose, reasonably foreseeable use and conditions of use, including its operating environment.
The law’s requirements are taking effect on different dates. Reporting duties for actively exploited vulnerabilities and severe incidents began Sept. 11, 2026. Provisions on notifying conformity assessment bodies applied from June 11, 2026, while most of the regulation applies from Dec. 11, 2027. EconoTimes previously covered a separate product-security partnership tied to the CRA.
exida says the software is an assessment aid: using it does not certify a product or guarantee that a manufacturer complies with the CRA. The company said it is pursuing accreditation as a CRA notified body.
The company also warned that manufacturers that do not meet the rules could face barriers to EU market access, regulatory sanctions and reputational damage. It did not give potential penalty amounts. The regulation’s general application date is Dec. 11, 2027.
