Z-CMS automates your Cyber Resilience Act compliance — risk assessment, gap analysis, vulnerability handling policies, threat modelling and much more, based on official draft standards prEN 40000 and EN IEC 62443 series.
Understanding the regulation
The Cyber Resilience Act (CRA) is the EU's cybersecurity regulation for all products with digital elements. It requires manufacturers to build in security by design, assess risks, handle vulnerabilities throughout the product lifecycle and maintain technical documentation.
10 Dec 2024
Entry into force (applies)
11 Jun 2026
Notified body rules (applies)
11 Sep 2026
Reporting obligations (applies)
11 Dec 2027
Full application
From 11 Dec 2027
Full application
414 days to go
Identify risks related to assets in your product
Handle vulnerabilities across the product lifecycle
Build in the required security controls
Give users the information set out in Annex II
Reporting obligations have applied since 11 September 2026. Notifications go directly to ENISA's Single Reporting Platform, as the CRA requires. Read our reporting guide
Sound familiar?
Knowing the requirements is one thing. Turning them into evidence for every product is where most teams get stuck.
prEN 40000-1-2, 1-3, 1-4, EN IEC 62443-4-1, the CRA annexes… The standards are dense, still in draft, and nobody tells you how they fit together or which parts apply to your product.
With Z-CMS: A guided Q&A built on the standards tells you what applies and what to do next.
Risk assessments, gap analyses, vulnerability handling policies, technical files. Writing them from a blank page can take hundreds of hours of your experts’ time.
With Z-CMS: Reports and policies are generated from your answers, not written from scratch.
Every product in your portfolio that falls under the CRA is its own compliance project. Doing them one by one by hand doesn’t scale, and every team ends up with a different result.
With Z-CMS: One repeatable process for every product in your portfolio, with consistent, reproducible output.
Z-CMS turns all three into one guided, repeatable workflow.
See how it worksHow Z-CMS solves it
Three features, each built on the official draft standards and guided step by step. More features are coming.
A guided Q&A that takes you through the full CRA risk assessment, from your product’s assets to the requirements that apply.
Generate a complete vulnerability handling policy in minutes instead of writing it from scratch.
A quick intelligent Q&A that measures your product’s readiness against the standards and the CRA text, and shows exactly where the gaps are.
Coming soon: as the standards mature, we're implementing full support for product requirements (prEN 40000-1-4, EN IEC 62443-4-2) and user documentation (CRA Annex II) in Z-CMS.
In their words
“With Z-CMS, we save considerable time and effort in our projects.”
We have been using Zealience's Z-CMS for RED (EN 18031) compliance, and we highly appreciate that it also comprehensively covers the Cyber Resilience Act (CRA). With Z-CMS, we save considerable time and effort in our projects.
Instead of having to work through the applicable standards and formulate all the content manually – from gap analyses and risk assessments through to vulnerability handling policies – the software provides a structured, guided approach. It simplifies the compliance process through targeted questions and automated suggestions, which not only reduces complexity but also ensures high quality in the documentation.
The dedicated CRA functions are particularly well-designed: the tool offers a guided gap analysis to systematically evaluate the specific CRA requirements. The risk assessment with product and threat modelling tie in perfectly with modern product architectures.
Equally valuable is the clear overview the software provides. The graphical flow is intuitive and easy to work with: at a glance, users can see exactly how the individual tasks and sections are structured. This visual guidance keeps the workflow transparent and makes the administration noticeably more efficient. Overall, Z-CMS provides a highly reliable foundation for managing CRA compliance.
A special mention goes to the team behind the software. Zealience maintains a strong update discipline and continuously improves the tool. The people there are always friendly and responsive, ready to answer any question. That reliable support makes a real difference in day-to-day work.
R. Nader
Developer for Embedded Self-Service Devices, Hectronic
Why Z-CMS
Built by IoT cybersecurity compliance experts, trusted by manufacturers worldwide for EN 18031 and now Cyber Resilience Act compliance.
100+
manufacturers brought to EN 18031 compliance
“Z-CMS has been a great resource for developing real cybersecurity expertise.”
Dr. Guillaume Dupont
Leads R&D, former tester at a global testing lab
In a field where interpretation errors lead to costly non-compliance, expert guidance is critical. Z-CMS is built on over a decade of IoT cybersecurity and compliance experience.
Your data never leaves your environment. Z-CMS runs entirely on infrastructure you control, on-premises or in your own private cloud, and needs no internet connectivity to operate. Zealience has no access: no SaaS analytics, no AI training, no external processing.
Our secure deploymentZealience connects you to trusted consultants, legal experts and Notified Bodies, for end-to-end Cyber Resilience Act compliance support in a field where expertise is scarce.
View servicesFAQ
Can't find what you're looking for? Our team is happy to walk you through your specific products and obligations.
Ask us directlyThe CRA applies to products with digital elements placed on the EU market: hardware and software that connect, directly or indirectly, to a device or network. Products already covered by certain sector-specific EU rules, such as medical devices, motor vehicles and civil aviation, are excluded. Once a product is in scope, the Z-CMS risk assessment determines which essential requirements apply to it.
Reporting obligations for actively exploited vulnerabilities and severe incidents apply since 11 September 2026. Most other obligations, including the risk assessment, vulnerability handling, product requirements and user documentation, apply from 11 December 2027.
The harmonised standards for the CRA are still being finalised. Z-CMS is built on the official drafts prEN 40000-1-2, prEN 40000-1-3 and prEN 40000-1-4, as well as EN IEC 62443-4-1, and we update it as the standards are finalised.
Risk assessment with built-in threat modelling (prEN 40000-1-2, EN IEC 62443-4-1), a vulnerability handling policy generator (prEN 40000-1-3), and a gap analysis that checks your product’s readiness against EN 18031, prEN 40000-1-4, prEN 40000-1-3 and CRA Annex II. Full support for product requirements and user documentation is coming as the standards mature.
No, and that is deliberate. The CRA requires manufacturers to notify actively exploited vulnerabilities and severe incidents through ENISA’s Single Reporting Platform (SRP). We recommend reporting there directly rather than through any third-party software.
Read our reporting guideYes. About two-thirds of EN 18031 is expected to be reused in prEN 40000-1-4, and Z-CMS covers both RED DA and the CRA, so the work you have already done gives you a head start. You can reuse information you have declared for EN 18031 for the CRA compliance.
In your own environment. Z-CMS runs fully within your infrastructure, either on-prem or in your own cloud. Zealience has no access to your data: no SaaS analytics, no AI training and no external processing.
Our secure deploymentZealience connects you to trusted consultants, legal experts and Notified Bodies, for end-to-end support beyond the software.
View servicesCRA full application in 414 days
See Z-CMS in a live demo with our founders, tailored to your products and your questions.
Send a demo request
One click opens an email to our team.
Pick a time
We reply with a booking link so you can choose a slot.
Get a tailored live demo
1 to 1.5 hours with our founders, built around your products and your questions.
