Your software, compliantwith the Cyber Resilience Act.
CheckOps lists every component in your software, warns you as soon as a security flaw affects one of them, and prepares the reports and evidence required by the European regulation (CRA).
The European regulation applies in stages. The first obligation is already in force.
Understand the CRA in 2 minutes →Send, monitor, fix, prove.
Keep your development tools. CheckOps receives the component list of each release, checks it every day against vulnerability databases, tells you what to fix first and turns it into what the CRA asks of you.
1 · Send, from your CI
One line to add to your delivery pipeline (GitLab, GitHub, Kubernetes, AWS). Every new release is analysed automatically, without changing the way you work.
Everything the CRA asks for, in one place
Component inventory, vulnerability monitoring, alerts, reports and evidence: one tool, one invoice, data in France.
Sovereign by default
Your SBOMs travel from all over Europe to France, to French hosting providers. CheckOps is published by a French company: your data is never copied outside the European Union.
2 · Monitor every component
One square per component of your software. When a flaw hits one, it lights up; it turns green again once fixed or declared harmless.
3 · Fix, starting with what is urgent
CheckOps ranks flaws by real danger: already used by attackers, likely, or harmless for you. For each one it explains in plain words what it allows, which version to install, and opens the fix for you.
- 1xz-utils 5.6.0 → 5.6.2Critical · already exploited · server takeoverFix opened
- 2openssl 3.0.7 → 3.0.15High · 12% attack risk · may bring the service downTo schedule
- 3lodash 4.17.20Harmless for you: the affected function is not usedDeclared not affected
Works with the tools you already use
CheckOps reads the standard formats (CycloneDX, SPDX) and the output of common security scanners. Alerts arrive by email or straight into your GitLab and Jira tickets.
4 · Prove it, on time
When attackers exploit a flaw in your product, the CRA gives you 24 hours to warn the authorities. CheckOps starts the countdown and pre-fills every notification.
A PDF your customer understands.
For every release you ship, a dated security report: number of components, open flaws, fixed flaws, harmless flaws and why. Readable by a customer, a buyer or an auditor, no expertise needed.
- Cites Regulation (EU) 2024/2847 and Article 14 of the CRA.
- Puts real emergencies first: flaws already exploited by attackers and likelihood of attack.
- Public security page, if you want one, to reassure your customers and receive vulnerability reports.
Generated on 25 Oct 2026
Regulation (EU) 2024/2847 (CRA)
Cyber Resilience Act: what changes for your products.
The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, strengthens the cybersecurity of hardware and software products with digital elements. It applies to everything sold in the European Union, from apps to connected devices.
Yes, if you sell in the EU a product that contains software: an app, subscription software installed at the customer’s site, a connected device, a machine driven by a program.
Know what is inside your products
Keep an up-to-date list of the software components of each release, like the ingredient list of a dish. It is called an SBOM.
CheckOps receives it from your tools and keeps it for every release.Fix flaws for the whole support period
Watch for published security flaws that affect your components and ship fixes, free of charge, usually for at least 5 years.
CheckOps warns you as soon as a flaw affects you.Report an exploited flaw within 24 hours
If attackers exploit a flaw in your product: early warning within 24 h, notification within 72 h, final report within 14 days, to ENISA and your national CSIRT.
CheckOps prepares each step and starts the countdown.Prove compliance and affix the CE marking
Document the measures you take and be able to show them to authorities, customers and in tenders.
CheckOps produces dated PDF reports for every release.Short glossary: SBOM, CVE, VEX, EUVD, NIS2
- SBOM
- Software Bill of Materials: the list of components in a piece of software, with their versions.
- CVE
- The public number of a security flaw, for example CVE-2024-3094.
- VEX
- A statement saying whether a flaw really affects your product or not, and why.
- EUVD
- The European Vulnerability Database, run by ENISA, the EU cybersecurity agency.
- NIS2
- Another EU directive, about the security of organisations rather than products.
Alerted only when it concerns you.
Dozens of security flaws are published every day. CheckOps compares them with the components of each of your releases and only warns you when one of your products is affected: which product, which version, which fix.
- European sources first: ENISA’s vulnerability database (EUVD), completed by the major international databases.
- Ranked by urgency: severity, attacks already seen, likelihood of attack.
- Fixed faster: a ticket for your developers, or an update proposal ready to approve.
Every vulnerability database, brought together.
Each security flaw is published by several bodies, in Europe and in the United States, each with its own details. CheckOps gathers them in its own database, hosted in France, and turns them into a single clear record per flaw.
- EUVDENISA · European Unionreference
- CERT-FRANSSI · Francealerts
- NVDNIST · United Statesdetails
- KEVCISA · already exploitedurgency
- EPSSFIRST · likelihood of attackscore
- OSV + GitHubopen source packages· being activatedpackages
- Debian · Ubuntu · Alpinedistribution advisories· being activatedsystems
Built for those who ship software.
You sell a product
The CRA makes you a manufacturer. Keep an SBOM per release and report on time.
- SBOM and VEX per release
- Guided CRA reporting
- Public security page
You deliver for others
Your customers ask for evidence. Give them a report with every delivery.
- PDF report per delivery
- Checks in the CI
- GitLab and Jira tickets
You run fleets
Follow the clusters of all your customers from a single screen.
- Multi-customer view
- Kubernetes agent
- NIS2 score per customer
Start for free, grow later.
Prices per month excluding VAT, no commitment. No surprises: beyond a limit, nothing extra is charged.
To try it on one product.
- 1 product
- 30 analyses per month
- Email alerts
- VEX, CRA reporting, NIS2 score
For a small team.
- 5 products
- 500 analyses per month
- 1 monitored Kubernetes cluster
- 3 alert channels
For a vendor with several products.
- 20 products
- 3,000 analyses per month
- 5 monitored Kubernetes clusters
- 10 alert channels
For IT services firms and MSPs.
- 100 products
- 20,000 analyses per month
- 20 monitored Kubernetes clusters
- Multi-customer view
CRA reporting, reports and NIS2 score included in every plan. One analysis = one component list or one scanner result uploaded. More than 100 products: Enterprise plan on quote (contact@checkops.eu).
Before you start.
What is the Cyber Resilience Act (CRA)?
The Cyber Resilience Act, Regulation (EU) 2024/2847, sets cybersecurity rules for all hardware and software products with digital elements sold in the European Union: security by design, fixing flaws during the support period, reporting exploited flaws and CE marking.
Does the CRA apply to my company?
Yes, if you place on the European market a product that contains software (an app, a connected device, embedded software). Reporting actively exploited vulnerabilities has been mandatory since 11 September 2026; the rest of the regulation applies from 11 December 2027.
Are my SBOMs shared with anyone?
No. They are stored in France and visible to your organisation only. The public security page only exists if you turn it on, product by product.
What is an SBOM and how do I get one?
An SBOM (Software Bill of Materials) is the list of components in a piece of software, with their versions. Most development tools can produce it automatically; CheckOps gives you the line to add to your delivery pipeline.
Which tools are supported?
CycloneDX and SPDX, plus the output of Syft, Trivy, Grype, OSV-Scanner, SARIF, GitLab security reports, Trivy Operator, Harbor and AWS Inspector.
What is the fine for not complying with the CRA?
Up to €15 million or 2.5% of worldwide annual turnover for breaching the essential requirements, whichever is higher (Article 64). Micro and small enterprises are not fined for missing the early-warning deadline.
How is it different from Dependency-Track?
Dependency-Track is a very good open source tool that you install and maintain yourself. CheckOps is a managed service in France that adds CRA reporting, the NIS2 score, PDF reports and the multi-customer view.
Do I need a credit card to try it?
No. The Free plan has no time limit. You move to a paid plan when you need it.