CRACI and the Race to Comply With the EU Cyber Resilience Act

European companies that build connected software or hardware are entering a new regulatory era. The EU Cyber Resilience Act (CRA) will soon require strict cybersecurity standards across the lifecycle of digital products. Startups are already emerging to help companies meet those obligations — including CRACI, a Finnish cybersecurity company focused on software supply‑chain security and compliance automation.

What CRACI Is

CRACI is a Finland‑based cybersecurity startup developing a platform designed to integrate security and compliance directly into software development workflows. The system connects security monitoring, vulnerability tracking, and remediation processes to developer pipelines so organizations can continuously manage software supply‑chain risks.

The platform integrates with widely used CI/CD tools such as GitHub, GitLab, and Jenkins, allowing security tasks to run alongside normal development activities. Instead of handling compliance through periodic audits or manual tracking, the platform automatically identifies vulnerabilities, assigns remediation tasks, and tracks fixes within the development pipeline.

This approach turns regulatory compliance from an after‑the‑fact documentation exercise into a continuous engineering workflow.

How Much Funding CRACI Has Raised

CRACI has raised €1.4 million in pre‑seed funding to develop its cybersecurity compliance platform.

Publicly available information confirms the funding amount but does not clearly identify the investors involved or detailed plans for how the funds will be allocated. Based on available reporting, those details have not been widely disclosed.

The Problem: Software Supply Chain Security

Modern software products rely heavily on open‑source libraries, third‑party components, and complex build pipelines. This creates a software supply chain where vulnerabilities can enter through dependencies, build tools, or integration systems.

Managing those risks is difficult because development teams must:

• Track vulnerabilities across multiple dependencies
• Document security processes
• Patch issues quickly
• Maintain lifecycle security updates

CRACI addresses this by connecting vulnerability discovery, tracking, and remediation directly into development pipelines, allowing teams to handle security issues as part of everyday development work rather than separate compliance processes.

Why the EU Cyber Resilience Act Is Driving Demand

The EU Cyber Resilience Act (CRA) is a sweeping cybersecurity regulation covering products with digital elements sold in the European Union. The law introduces mandatory security requirements for both hardware and software manufacturers.

Key goals of the regulation include:

• Ensuring digital products are designed with cybersecurity in mind
• Reducing vulnerabilities across the technology supply chain
• Requiring manufacturers to provide security updates and maintain product security throughout the product lifecycle

The rules apply broadly to connected products, including software applications, operating systems, embedded systems, and devices connected to networks.

For many companies, compliance requires new processes for vulnerability management, documentation, and reporting across development teams.

The CRA Timeline: 2026 and 2027 Deadlines

The Cyber Resilience Act officially entered into force in December 2024, but companies are currently in a transition period.

Two upcoming milestones are particularly important for businesses:

• 11 September 2026: Manufacturers must report actively exploited vulnerabilities and major incidents to EU cybersecurity authorities.
• 11 December 2027: Full compliance becomes mandatory before products with digital elements can be placed on the EU market.

Because of the long development cycles for many products, companies are already preparing their software pipelines to meet these requirements.

How CRACI Helps Companies Prepare

CRACI’s platform is built around the idea that compliance should happen inside developer workflows rather than in external audit processes.

By embedding security tooling into CI/CD pipelines, the system helps organizations:

• Automatically detect vulnerabilities in software dependencies
• Track and document remediation efforts
• Assign fixes to developers
• Maintain traceable security records

These capabilities support the type of continuous security monitoring and lifecycle management expected under the Cyber Resilience Act.

Why Startups Like CRACI Matter Now

The Cyber Resilience Act represents one of the first major regulatory frameworks focused specifically on software supply chain security at scale.

Because the regulation affects nearly every connected product sold in the EU, organizations across industries — from device manufacturers to software vendors — will need new tools and workflows to demonstrate compliance.

Platforms that automate vulnerability management, documentation, and remediation inside development pipelines are likely to become a key part of that transition.

CRACI is one of the early startups positioning itself in that emerging compliance and supply‑chain security market as European companies prepare for the 2026 and 2027 CRA deadlines.