CRA Compliant Firmware Development for Connected Products
The EU Cyber Resilience Act is already in force, with a 24 hour exploited-vulnerability reporting rule live since 11 September 2026. We build the secure boot, secure OTA, and SBOM practices your firmware needs to meet it, not just a promise.
Firmware built for a regulation that is already live
- Secure boot and signed firmware images, so an unauthorized build cannot run on your hardware
- Secure over-the-air update infrastructure, built to be patchable the moment a vulnerability is found
- A generated Software Bill of Materials (SBOM), in CycloneDX or SPDX format, for every firmware release
- Vulnerability handling built into the development process itself, not bolted on before an audit
- A real office in Ludwigsburg, Germany, for a face-to-face point of contact on EU compliance questions
- The same team that writes the firmware also owns the mechanical and PCB design around it, so security is not an isolated afterthought
Our CRA Readiness Process
The same disciplined process whether this is your first connected product or a firmware update to an existing one.
Architecture & Threat Review
Your product architecture is reviewed for secure boot, update, and communication requirements before firmware development starts.
Secure Firmware Development
Firmware is written with signed images and a secure boot chain built in from the first commit, not added at the end.
SBOM Generation
A Software Bill of Materials is generated and versioned alongside every firmware release, in CycloneDX or SPDX format.
OTA Update Infrastructure
A secure over-the-air update path is built so a discovered vulnerability can be patched in the field, not just documented.
Documentation & Handover
Architecture, SBOM, and vulnerability-handling documentation are handed over in a form your compliance team can actually use.
Where CRA Compliant Firmware Applies
The CRA applies to any product with digital elements sold into the EU. The firmware discipline is the same across categories.
Connected home and lifestyle products with a network-facing attack surface.
Embedded controllers and monitoring hardware sold into EU industrial buyers.
Battery powered connected devices with firmware that must stay patchable in the field.
Connected sensors and gateways deployed at scale across a facility or fleet.
Products where a firmware compromise has real physical-security consequences.
Connected devices where secure update infrastructure is already an expectation, not new.
What Founders Ask About the EU Cyber Resilience Act
Is the Cyber Resilience Act actually in force yet, or is this still a future deadline?
The CRA's 24 hour exploited-vulnerability reporting obligation is already in force, live since 11 September 2026. Full binding enforcement across the rest of the regulation lands December 2027, with penalties running up to €15M or 2.5% of global turnover for non-compliance.
Does the CRA actually apply to firmware, or just software sold as a standalone product?
It applies to any product with digital elements sold into the EU, which explicitly includes embedded firmware. Secure boot, secure update mechanisms, and a Software Bill of Materials are named requirements, not implied ones.
What is an SBOM and why does our firmware need one?
A Software Bill of Materials is a structured list of every software and firmware component in your product, in a standard format like CycloneDX or SPDX. The CRA requires one so a known vulnerability in a component can be traced to every affected product quickly.
Does CADLETE issue CRA compliance certification?
No. We build the firmware engineering practices the CRA requires, secure boot, secure OTA infrastructure, SBOM generation, and vulnerability handling built into the development process, and hand over documentation your compliance or legal team can use. Formal regulatory certification is a legal process, not something an engineering partner issues.
We're a US company, does the CRA apply to us?
If your product is sold into the EU market, the CRA applies regardless of where your company is headquartered. This is common enough that we build the same secure boot, OTA, and SBOM practices into firmware for US clients shipping into the EU as we do for our German clients directly.
How does communication work if your engineering team is based in India?
Our office in Ludwigsburg gives you a real point of contact in Germany for EU compliance questions, in addition to our firmware and PCB engineering team in India.
How do you protect our source code and firmware IP, given the CRA is itself about supply chain security?
A non disclosure agreement and any written IP paperwork your project needs are signed before any code or design file is shared, and you own the source code and firmware IP outright on delivery. All development is done in-house by our own engineers, nothing is subcontracted to China or a third-country vendor, so your code never leaves our facility or passes through any other party, the same supply chain discipline the CRA itself is written to enforce.
Trusted By Product Companies Worldwide
Verified reviews from clients in USA, UK, Germany, Australia, Canada and more.
Real Firmware, Built for Products Already in the Field
Pickleball Scoring System
A wireless scoring device: PCB design, firmware, enclosure across 3 mounting variants, and wristband sync, built for a USA client.
Low-Cost Air Purifier
PCB design and an injection molded enclosure engineered together to hit a mass market price point without cutting reliability.
Ethernet Tester
Electronics integration and an injection molded housing brought together into one production-ready diagnostic tool.
READY TO BUILD?
Build firmware that meets the CRA, not just a deadline
Talk to a real engineer, with a real point of contact in Ludwigsburg, Germany.