Resilic makes your machines in the field ready to report: products, SBOMs, vulnerability correlation and the Article 14 report in one workflow. The duty has applied since 11 September 2026, including to machines already shipped. AI drafts; you sign.
No credit card · 30-day trial · Set up in an afternoon
Fleet loaded by CSV, software bills of materials (SBOMs) imported, first matches the same day: you see which shipped machine is hit by an actively-exploited vulnerability (CVE), correlated across the EUVD, NVD and CISA KEV vulnerability databases.
When a report is due, the Article 14 draft is ready for all three stages, cited to its sources and mapped to the ENISA platform’s fields. You review and sign; nothing is auto-submitted.
Resilic counts down the deadline for every reportable event: 24 hours to the early warning, 72 hours to the notification. Reminders to your team make sure no deadline catches you out.
The obligations do not arrive all at once but in four stages, and each stage builds on the one before. Start with Article 14 reporting. Then cover the remaining obligations step by step on the same platform, without ever starting over.
Most teams are ready within an afternoon. You bring your products and SBOMs; Resilic does the correlation and the first draft.
Add every product, version and customer deployment, by hand or by CSV import. The bill of materials per version comes from your CycloneDX or SPDX SBOM, from assembling it from components, or from Resilic Edge in the control cabinet; AI matches components to known identifiers for you to confirm.
Resilic correlates your components against the European vulnerability database EUVD, the US database NVD and the CISA KEV catalogue of vulnerabilities known to be exploited: actively-exploited first, plus EPSS, the estimated probability of exploitation. AI triage explains whether a CVE really affects your product, with sources cited.
When a report falls due, an assistant walks you field by field through the ENISA Single Reporting Platform form, with AI drafts already filled in. A deadline display shows at any time where you stand in the cascade. You review, edit and sign. Nothing leaves the system without your approval.
Not a general vulnerability scanner for software teams and not a compliance tool that only delivers slides in the end. Resilic is built around the daily work of machine builders.
One view answers the question: "Is any shipped machine at risk right now?" Your fleet, matched against EUVD, NVD and CISA KEV, sorted by active exploitation and EPSS. Each row shows the affected products and the recommended next step. When a vulnerability is actively exploited, you start the Article 14 report with one click.
For every shipped machine you see which customer runs it and which software version is installed there. Next to it: the state of the SBOM, open vulnerabilities and the end of the support period.
Import CycloneDX and SPDX bills of materials; AI matches components to known identifiers, you confirm with confidence shown. When a new vulnerability appears, you know the same day whom it hits.
A staged form for early warning, notification and final report, mapped to the ENISA platform, with live countdowns. Export opens only after your sign-off: you file, never the software.
Request SBOMs and commitments through a simple portal in your branding, and qualify suppliers with a structured questionnaire. You see who has delivered and who still owes.
What was reported and who signed it is recorded with timestamp and author and cannot be changed afterwards. An assessor finds the signature, not an email.
A CVD policy and CRA technical documentation from templates, AI-drafted and human-approved. You never start from a blank page, and the draft-or-approved state is always visible.
Approve a security advisory and Resilic publishes it as a signed CSAF 2.0 feed under your verified domain, with security.txt and a daily refresh. Your customers find your advisories where aggregators such as the EUVD expect them.
Draft your AI-use policy or upload the one you have. Staff confirm it through a personal link. Export the evidence pack for Article 4 of the AI Act whenever you need it. This duty already applies today to every organisation that uses AI.
A small scanner in the control cabinet records the devices on the machine network over common industrial protocols such as PROFINET, EtherNet/IP, Modbus and OPC UA, and identifies vendor, type and firmware. At commissioning you confirm the mapping, and it becomes the software bill of materials of the shipped machine. From then on the scanner reports every deviation, and at handover to the operator you keep read access.
Machine builders have to meet several overlapping regulations at once. Tools made for software houses or corporate compliance do not fit. Resilic is built for the CRA and the daily work of machine building.
A scanner gives you a list of CVEs. Resilic tells you which of them affect a shipped machine, puts actively exploited vulnerabilities first and drafts the Article 14 report from there.
Generic compliance checklists were written neither for the CRA nor for machinery. Resilic maps the machine builder's work: machines in the field, software bills of materials, suppliers, vulnerabilities and reports in one place.
A consultancy delivers slides and leaves. Resilic stays: the software keeps working between audits, and your evidence can be reused for the CRA, the Machinery Regulation and the AI Act.
Under the CRA a connected machine is a "product with digital elements" and at the same time machinery under the Machinery Regulation. If it embeds high-risk AI in future, the AI Act is added. The obligations overlap. Resilic keeps one body of evidence and shows for each item which regulation it satisfies.
You switch on the Machinery Regulation and AI Act modules in the same account as those deadlines approach: no migration, no double entry.
In a regulated domain, a black box is a liability. Every AI output in Resilic is drafted, cited and clearly labelled; then it waits for a human. Nothing is auto-submitted, ever.
This vulnerability in OpenSSL 3.0.x is likely exploitable in your PalletBot-X2 firmware 4.2: the affected TLS renegotiation path is reachable from the machine's remote-maintenance interface. An Article 14 report is recommended.
What actually earns your trust in a regulated domain.
Three practice cases you may recognise yourself in.
Priced by the number of your products, with no hidden quotes. A product is a product line or platform; the custom products derived from it do not count. Start on a 30-day trial and upgrade when you're ready.
Answer five questions and get an honest read on your scope, your deadlines, and where to start. Most machine builders are in scope, but not for everything at once. We'll tell you exactly which.
We'd rather be precise than alarmist. Here's what Resilic does — and what it deliberately doesn't.
No. Anyone who claims that is overselling. Our first building block is Article 14 readiness: detect exploited vulnerabilities in your fleet and stand up the reporting workflow. Full CRA conformity (Dec 2027) is a later expansion on the same platform.
Start now; the obligation covers products already in the field. The CRA has real teeth: penalties reach up to €15 million or 2.5% of global annual turnover, and market-surveillance authorities can restrict or withdraw a product. We won’t fear-sell that: the point of Resilic is to get you ready within days, with the evidence to show it.
No. Resilic drafts and organises everything to match the ENISA Single Reporting Platform, but a human always reviews and submits. AI drafts; you sign.
For actively-exploited vulnerabilities and severe incidents, Article 14 requires an early warning within 24h, a notification within 72h, and a final report: for a vulnerability no later than 14 days after a corrective or mitigating measure is available, for an incident within one month of the 72-hour notification. Resilic tracks each stage with a live countdown.
Very likely yes: the CRA is explicitly extraterritorial. If you place products with digital elements on the EU market, you're in scope regardless of where you're headquartered.
EUVD, NVD and the CISA KEV catalogue, with EPSS for exploitation-probability context. Actively-exploited issues are always surfaced first.
CVE is the identifier used worldwide for a known vulnerability, such as CVE-2026-12345. An SBOM (software bill of materials) lists which software components a product contains. EUVD is the European vulnerability database run by ENISA; NVD is its US counterpart run by NIST. KEV is the catalogue kept by the US agency CISA of vulnerabilities known to be actively exploited. EPSS estimates the probability that a vulnerability will be exploited within the next 30 days.
All terms in the glossaryYour data lives in the EU. AI drafts are produced by an external provider under contract, and your content is not used to train AI models. Every draft is labelled as an AI draft, and nothing is submitted without your signature. The details of the processing are in the privacy policy.
Set up your fleet, see your first vulnerability result, and know your Article 14 position — the obligation applies today, to products already in the field.
Occasional notes on CRA deadlines, ENISA guidance and Article 14 practice for machine builders.