CRA readiness, in plain English.
EU Cyber Resilience Act, Regulation (EU) 2024/2847
A fixed-price diagnosis of the evidence gaps in your software for the EU Cyber Resilience Act. We prepare the work. You decide and sign.
Free. Two minutes. No sign-up. Your answers stay in your browser. Also free: the reporting clock.
Two dates that matter
11 September 2026 (Art. 14): Reporting is already live. Manufacturers must report actively exploited vulnerabilities and severe incidents, with a first notice within 24 hours.
11 December 2027 (Arts. 13 and 14, Annexes I and VII): Full obligations apply: security by design, vulnerability handling, technical documentation and an EU declaration of conformity.
Source: Regulation (EU) 2024/2847 on EUR-Lex (link: https://eur-lex.europa.eu/eli/reg/2024/2847/oj). Confirm dates against the official text.
How it works
Run the free scope check.
Buy the diagnosis and send your SBOM (CycloneDX or SPDX) and your answers.
Receive a gap list and a checklist of missing evidence. Each item names its source.
Optional: add the Documentation Pack, with drafts for you to review and sign.
- • Validate your SBOM file: components, versions, licences, suppliers and relationships.
- • Review 18 checkpoints against the evidence you give us.
- • Draft documents for you to review and sign (Documentation Pack).
- • We do not certify, give legal advice, test your code or find vulnerabilities.
- • We do not act as a third-party assessment body.
- • You review, decide and sign.
Free Scope Check
Question 1 of 5What do you distribute?
Reporting clock
If you learn that a vulnerability in your product is being actively exploited, the reporting clock starts. Enter when you became aware and see your deadlines.
| Obligation | Local Time | UTC | Status |
|---|---|---|---|
| Early warning: within 24 hours of becoming aware | |||
| Vulnerability notification: within 72 hours of becoming aware | |||
| Final report: within 14 days after a fix or mitigation is available |
An estimate based on Art. 14 for actively exploited vulnerabilities. Severe incidents follow a similar 24-hour and 72-hour pattern, with a final report within one month. Confirm against the official text and the current reporting instructions. Nothing you enter leaves your browser.
Pricing
Prices in euros, for business customers only. Pilot prices apply to the first three customers.
Your likely category, the sources behind it and how certain we are.
• SBOM file validation
• Review of 18 checkpoints, grouped by area
• Gap list and missing-evidence checklist
• PDF report with citations and an action plan
• One free re-check of your SBOM after you fix it (within 30 days)
• Vulnerability handling policy
• Reporting playbook for the 24-hour, 72-hour and 14-day notices
• Evidence matrix and action list
• Drafts pre-filled with your product's data
• A two-page readiness summary for your customers' security questionnaires (self-declared, not a certificate)
• One round of changes
Keeps your 18-point map current: a re-check of your SBOM with each release and a monthly summary of changes that affect you.
• If we can't take your product after you pay, you get a full refund.
• Delivery times are counted from the day we have everything we need. Business days are Monday to Friday in Peru time (UTC-5), excluding public holidays in Peru. If we are late, you get 25% back.
Frequently Asked Questions
Does this make me compliant?
No. It shows what is missing and prepares drafts. The manufacturer is responsible for compliance and signs the declaration of conformity.
What about my SaaS?
A cloud service on its own is generally outside the CRA. It can be in scope when it is part of a product you ship, such as an app or device that depends on it.
What do you need from me?
Your answers and an SBOM file. We never ask for source code, repository access or passwords.
What happens to my files?
We use them only to prepare your report and delete them 30 days after delivery, or earlier if you ask. See the privacy policy.
Who is responsible?
The manufacturer. We prepare the work. You review, decide and sign.
What are the penalties?
For the most serious breaches, fines can reach EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher (Art. 64).
How we work
Sources: Regulation (EU) 2024/2847 and the Commission's guidance of 27 July 2026, including its worked examples. The guidance is not binding.
The scope check: A fixed decision tree with five questions, applied in the same order every time. The same answers give the same result. Each result shows its source and how certain we are, and says 'we can't tell yet' when we are not sure. We test it on 50 test cases, including examples from the Commission's guidance. Rules version 0.1.
The Diagnosis: We count what is in your SBOM file: components, versions, licences, suppliers and relationships. We review 18 checkpoints. A checkpoint is marked 'Evidence provided' only when you give us evidence, never because the answer was yes. We do not scan code or look for vulnerabilities.
Who is responsible: Gene Martinez reviews every report before it is sent. We may use AI tools to help draft text. They never decide a status.
Limits: This is not legal advice, a certification or a security test. The manufacturer is responsible for compliance, and you decide and sign.
Corrections: If you find an error, write to hello@quillbind.com. We will check the official text and fix it.
About
I'm Gene Martinez, the person behind Quillbind. I work from Peru and serve software teams in the EU, remotely. I started Quillbind to give small software teams a clear, fixed-price way to see where they stand with the EU Cyber Resilience Act. I read your SBOM and your evidence myself. I use AI tools to help draft text, but a person reviews every report before it is sent, and I never upload your files to third-party AI services. This is a new service. If something is unclear or wrong, write to hello@quillbind.com. I read every email myself.
Terms of Service
1. Who we are. Quillbind is the trading name of Gene Martinez, a sole trader based in Peru. Contact: hello@quillbind.com.
2. The services. The free scope check and reporting clock, the Diagnosis, the Documentation Pack and, when available, Watch, as described in the pricing section.
3. What we do not do. We do not certify, give legal advice, test your code or find vulnerabilities. We prepare documents and reports. You are responsible for your product's compliance, and you review, decide and sign.
4. Business customers only. You confirm that you act for a business and, where it applies, give us your VAT number.
5. Orders and payment. Prices are in euros. Payment is made through PayPal before work starts. We send an invoice with each order. If you are an EU business with a valid VAT number, we invoice without VAT and you account for it under the rules of your country.
6. Delivery. The Diagnosis is delivered within 3 business days and the Documentation Pack within 7, counted from the day we have everything we need. Business days are Monday to Friday in Peru time (UTC-5), excluding public holidays in Peru. If we are late, you receive 25% of the fee for that service back, if you ask within 30 days.
7. If we cannot take your product. We confirm your product category at the start of the review. If it turns out to be outside what we cover, we refund the fee in full.
8. After delivery. No refund applies once the report or drafts have been delivered, because the work cannot be returned. If a delivered document has a factual error, we correct it free of charge. The Diagnosis includes one free re-check of your SBOM after you fix it, within 30 days. The Documentation Pack includes one round of changes, requested within 14 days of delivery.
9. Waitlist and Watch. If you join the Watch waitlist before it opens, you can subscribe at EUR 79 per month (or EUR 790 per year) when it opens. The price stays the same while your subscription continues without a break.
10. Your responsibilities. You give us accurate information and you have the right to share the files you send. We never ask for source code or passwords.
11. Our work and your use. Reports and drafts are yours for internal use and to share with your customers. Our rules, templates and tools remain ours.
12. Liability. We are not liable for indirect or consequential losses. Our total liability for a service is limited to the fee you paid for it. Nothing here excludes liability that cannot be excluded by law.
13. Changes. We may update these terms. The version in force on the date of your order applies to it.
Privacy Policy
Who is responsible: Gene Martinez, trading as Quillbind, a sole trader based in Peru. Contact: hello@quillbind.com.
The free tools: The scope check and the reporting clock run in your browser. Nothing you enter is sent to us. This site does not use cookies at the moment. If that changes, we will update this page.
What we collect: If you join the waitlist: your email and your consent. If you buy: your name, business, business email, VAT number and billing details. PayPal handles the payment and we do not see your card number. We also receive the files and answers you send us, such as an SBOM, a questionnaire and documents.
Why we use it: To deliver the service, invoice you and answer you (contract and legal obligations). To tell you when the pilot or Watch opens, only if you agree (consent).
How long we keep it: Files are deleted 30 days after delivery, or earlier if you ask. Waitlist emails are kept until you withdraw your consent. Invoices and payment records are kept as long as the law requires.
Who else sees it: Only the providers we need to run the service: PayPal for payments, and our hosting, email and form providers. We do not sell data. We do not upload your files or documents to third-party AI services. We may use AI tools to help draft text from short notes that do not include your name, your company or the content of your files.
Where it is processed: We are based in Peru, so your data is processed in Peru and by our providers, which may be located elsewhere.
Security: We work on client files on a private, encrypted computer, limit access to them and delete them after the retention period.
Your rights: You can ask to see, correct or delete your data, or to withdraw consent, by writing to hello@quillbind.com.
Changes: We will update this page if our practices change.
Refund and Late-Delivery Policy
- • Out of scope: if, at the start of the review, we find your product is outside what we cover, you get a full refund.
- • Late delivery: if we miss the delivery date, you get 25% of the fee for that service back. Ask within 30 days.
- • Corrections: the Diagnosis includes one free re-check of your SBOM after you fix it. The Documentation Pack includes one round of changes, requested within 14 days of delivery. A factual error in a delivered document is corrected free of charge.
- • After delivery: no refund applies once the report or drafts have been delivered, because the work cannot be returned.