Resilic makes your machines in the field ready to report: products, SBOMs, vulnerability correlation and the Article 14 report in one workflow. The duty has applied since 11 September 2026, including to machines already shipped. AI drafts; you sign.
No credit card · 30-day trial · Set up in an afternoon
Fleet loaded by CSV, SBOMs imported, first matches the same day: you see which shipped machine is hit by an actively-exploited CVE, correlated across EUVD, NVD and CISA KEV.
When a report is due, the Article 14 draft is ready for all three stages, cited to its sources and mapped to the ENISA platform’s fields. You review and sign; nothing is auto-submitted.
Every reportable event carries its clock: 24 hours to the early warning, 72 to the notification, with reminders to your team, so no deadline catches you out.
The Cyber Resilience Act doesn't arrive all at once. It lands in waves, and each wave reuses the work from the last. Start with Article 14 and cover the remaining obligations on the same platform, step by step; you never start over.
Most teams are ready within an afternoon. You bring your products and SBOMs; Resilic does the correlation and the first draft.
Add every product, version and customer deployment, by hand or by CSV import. The bill of materials per version comes from your CycloneDX or SPDX SBOM, from assembling it from components, or from Resilic Edge in the control cabinet; AI matches components to known identifiers for you to confirm.
Resilic correlates your components against EUVD, NVD and the CISA KEV catalogue: actively-exploited first, with EPSS context. AI triage explains whether a CVE really affects your product, with sources cited.
When a report is required, a guided editor maps to the ENISA Single Reporting Platform fields with the AI-drafted content pre-filled. A live deadline panel tracks the cascade. You review, edit and sign; nothing leaves without you.
Not a generic AppSec scanner and not a slide-deck GRC tool. A workflow built around how machine builders actually work.
The one view that answers "is any fielded machine at risk right now?" Your fleet, matched against EUVD, NVD and CISA KEV, prioritised by active exploitation and EPSS. Each row carries the affected products and the suggested next action, and a one-click Start Article 14 report when it's exploited.
You know which machine runs which version at which customer today, with SBOM, vulnerability and support-period status beside it.
Import CycloneDX and SPDX bills of materials; AI matches components to known identifiers, you confirm with confidence shown. When a new vulnerability appears, you know the same day whom it hits.
A staged form for early warning, notification and final report, mapped to the ENISA platform, with live countdowns. Export opens only after your sign-off: you file, never the software.
Request SBOMs and commitments through a simple portal in your branding, and qualify suppliers with a structured questionnaire. You see who has delivered and who still owes.
What was reported and who signed it is recorded with timestamp and author and cannot be changed afterwards. An assessor finds the signature, not an email.
A CVD policy and CRA technical documentation from templates, AI-drafted and human-approved. You never start from a blank page, and the draft-or-approved state is always visible.
Approve a security advisory and Resilic publishes it as a signed CSAF 2.0 feed under your verified domain, with security.txt and a daily refresh. Your customers find your advisories where aggregators such as the EUVD expect them.
Draft your AI-use policy or upload the one you have, let staff confirm it through a personal link, and export the AI Act Article 4 evidence pack — the duty that already applies to every organisation using AI.
An on-premise scanner finds machines and firmware on the plant network, PROFINET included, and matches them to your register — so the fleet view reflects what is actually installed.
Machine builders face a stack of overlapping regimes, and tools built for horizontal software teams don't fit. Resilic is built around the CRA and how machine builders actually work.
Scanners list CVEs. Resilic tells you which ones hit a machine you have shipped, prioritised by active exploitation, then drafts the Article 14 report.
Generic checklists weren't written for the CRA or for machinery. Resilic is a workflow for machine builders: machines in the field, SBOMs, suppliers, vulnerabilities and reports in one place.
A retainer produces slides. Resilic is software you own that keeps working between audits: your evidence reusable across CRA, Machinery and the AI Act.
A connected machine is a "product with digital elements" under the CRA and machinery under the Machinery Regulation, and may soon embed high-risk AI. The obligations overlap. Resilic keeps one body of evidence and shows which regime each row satisfies.
Machinery Regulation and AI-Act modules expand from the same account as those deadlines approach: no migration, no re-entry.
In a regulated domain, a black box is a liability. Every AI output in Resilic is drafted, cited and clearly labelled; then it waits for a human. Nothing is auto-submitted, ever.
This vulnerability in OpenSSL 3.0.x is likely exploitable in your PalletBot-X2 firmware 4.2: the affected TLS renegotiation path is reachable from the machine's remote-maintenance interface. An Article 14 report is recommended.
What actually earns your trust in a regulated domain.
Three practice cases you may recognise yourself in.
Priced by the number of your products, with no hidden quotes. A product is a product line or platform; the custom products derived from it do not count. Start on a 30-day trial and upgrade when you're ready.
Answer five questions and get an honest read on your scope, your deadlines, and where to start. Most machine builders are in scope, but not for everything at once. We'll tell you exactly which.
We'd rather be precise than alarmist. Here's what Resilic does — and what it deliberately doesn't.
No. Anyone who claims that is overselling. Our first building block is Article 14 readiness: detect exploited vulnerabilities in your fleet and stand up the reporting workflow. Full CRA conformity (Dec 2027) is a later expansion on the same platform.
Start now; the obligation covers products already in the field. The CRA has real teeth: penalties reach up to €15 million or 2.5% of global annual turnover, and market-surveillance authorities can restrict or withdraw a product. We won’t fear-sell that: the point of Resilic is to get you ready within days, with the evidence to show it.
No. Resilic drafts and organises everything to match the ENISA Single Reporting Platform, but a human always reviews and submits. AI drafts; you sign.
For actively-exploited vulnerabilities and severe incidents, Article 14 requires an early warning within 24h, a notification within 72h, and a final report: for a vulnerability no later than 14 days after a corrective or mitigating measure is available, for an incident within one month of the 72-hour notification. Resilic tracks each stage with a live countdown.
Very likely yes: the CRA is explicitly extraterritorial. If you place products with digital elements on the EU market, you're in scope regardless of where you're headquartered.
EUVD, NVD and the CISA KEV catalogue, with EPSS for exploitation-probability context. Actively-exploited issues are always surfaced first.
Your data lives in the EU (AWS Frankfurt). AI drafts are produced by a Claude model from Anthropic through its API; under the provider’s terms your content is not used to train the models. EU processing of the AI calls is prepared but not active today. Every draft is labelled AI-drafted, and nothing is submitted without your signature.
Yes. Resilic is built for German and English from day one, with WCAG AA contrast and full keyboard navigation, designed with longer German strings in mind.
Set up your fleet, see your first vulnerability result, and know your Article 14 position — the obligation applies today, to products already in the field.
Occasional updates on Cyber Resilience Act milestones, ENISA guidance and Article 14 practice for machine builders. No spam, unsubscribe any time.