Permenta is built for companies that sell software and connected products into the EU. It walks you through every obligation under the Act and keeps the evidence as you go: product registry and scope, SBOMs and vulnerability monitoring, Article 14 reports filed inside the deadlines, the technical file and declaration of conformity, security advisories, and a record you can hand to a customer or an authority throughout the Act’s ten-year retention period.
Permenta is opening to its first customers now. Free for one product; no card needed.
Regulation (EU) 2024/2847
The Cyber Resilience Act applies to every product with digital elements placed on the EU market, wherever the company behind it is based, with no exemption for small companies. Reporting obligations are already in effect; the rest of the Act follows in December 2027.
Article 14 reporting applies: actively exploited vulnerabilities and severe incidents must be reported to ENISA and your national CSIRT within 24 hours, 72 hours and 14 days or one month. It covers products already on the market.
The Act applies in full: Annex I secure-by-design requirements, an SBOM, vulnerability handling, a support period, the technical documentation of Annex VII, the EU declaration of conformity and CE marking.
The technical documentation and the declaration of conformity must be kept for ten years after a product is placed on the market, or for its support period if that is longer, and each security update must stay available for ten years after it is issued, or for the rest of the support period if that is longer.
Six modules in the order the work happens: register, know what is inside, watch, report, document, prove.
Register each product once. The wizard walks the Act’s scope questions and product classes and records the answer with its reasoning, including an honest “uncertain, seek advice” outcome.
Default, important class I and II, and critical products; legacy products placed on the market before 11 December 2027.
Upload SBOMs from CI. Components are matched against vulnerability feeds every day; a finding keeps its identity across releases, so triage and VEX statements survive the next upload.
CycloneDX 1.4 to 1.7 and SPDX 2.3; matched against OSV, KEV, EUVD and EPSS.
When an actively exploited vulnerability or a severe incident surfaces, open a case and the clocks start. Guided forms mirror the Single Reporting Platform field by field, and every submission is recorded with its timestamps.
24 hours for the early warning, 72 hours for the notification, 14 days for the final report on a vulnerability (one month for an incident).
An Annex VII-structured workspace with editable drafts, evidence coverage per section, approvals and versioned exports. Every generated document says it is a draft until you have reviewed it.
Annex VII structure, Annex V declaration; tagged PDF, Markdown and ZIP exports.
Publish machine-readable advisories with a human-readable page, an index that CSAF consumers can discover, and the contact files the Act and RFC 9116 expect.
CSAF 2.0 with provider-metadata.json, security.txt and a coordinated-disclosure policy.
Every release, update, advisory, support period and filing is appended to a hash-chained ledger. A public trust page per product shows customers and authorities what you publish, and expiring share links open the record to auditors.
Append-only, kept for ten years: the retention period the Act sets for technical documentation.
Every release, finding, filing and advisory is appended to a hash-chained ledger with its evidence. Nothing is edited later, only added, so what you show a customer or an authority in ten years is what happened.
Kestrel Router firmware
Sample record, release 4.2
Release 4.2.1 registered
SBOM anchored: CycloneDX 1.6, 412 components, three licences flagged for review.
Actively exploited vulnerability matched
A bundled library is on the KEV and EUVD lists. Article 14 case opened; the 24-hour clock started.
Early warning submitted
Single Reporting Platform reference recorded, 17 hours and 6 minutes after awareness.
Security update 4.2.2 published
Availability recorded for the rest of the support period, as Article 13(9) asks.
Advisory published
CSAF 2.0 document issued; the public trust page updated itself.
Final report submitted
Four days after the fix was available. Case closed; every step above stays on the record.
Teams of five to two hundred who ship products with digital elements into the EU, use GitHub or GitLab, and have no compliance department.
Based outside the EU? The Act applies to products placed on the EU market wherever the maker sits, and exporters are the least served by EU-local vendors. Permenta is built with you in mind: prices in euro or dollars, Article 14 guidance written for a first-time reporter, and a public trust page that answers your European customers before they ask.
Agencies and consultancies serving several such clients get separate workspaces per client on the Scale plan.
A free workspace for one product, then Starter, Growth and Scale in euro or US dollars, monthly or annual. Prices exclude VAT; paid plans start with a 14-day trial.
€0 or $0 forever
Your first product, on the record.
€99 or $99 per month
€990 or $990 per year
A small catalogue with live monitoring.
€299 or $299 per month
€2,990 or $2,990 per year
Several products and people who need to see the evidence.
€799 or $799 per month
€7,990 or $7,990 per year
Whole portfolios and agencies.
Prices exclude VAT, which is charged where the law requires it; businesses in the EU with a VAT number are invoiced under the reverse-charge mechanism. Paid plans start with a 14-day trial, renew automatically and can be cancelled for the end of the paid period from the workspace’s billing settings. Payment is by card through Stripe; invoices are issued electronically. See the cancellation and refund policy and the terms of service.
Permenta provides tooling and evidence management; it does not certify compliance. Whether a product meets the Act’s requirements is your assessment, or your notified body’s. Permenta makes the work easier to do and the evidence easier to keep and show. Nothing on this site is legal advice.
Permenta is operated by Patchgate, LLC, a United States company, doing business as Permenta. We answer within two business days.