Your calibration software is now a CRA-regulated product

A security questionnaire lands on your desk from a Tier 1 customer. Between the questions about your network and your suppliers, there is a new one: Are the software products you rely on for quality records compliant with the EU Cyber Resilience Act? You forward it to IT, IT forwards it back, and it settles on the quality function — because the tool in question is the one that holds your calibration due dates, your as-found/as-left results, and your certificates. Nobody in the building is quite sure who owns the answer.

That question is not going away, and it is not the same question you already answered for NIS2. As of 11 September 2026, the reporting obligations of the Cyber Resilience Act (Regulation (EU) 2024/2847) are live. The software that runs your calibration programme is, in the language of the regulation, a product with digital elements — and that changes what you should be asking the vendor who supplies it.

Why your calibration tool counts as a "product"

The CRA regulates products with digital elements placed on the EU market — and its definition is deliberately broad. It covers hardware, but it explicitly covers software too, including software provided as a standalone product. A calibration management application, whether it sits on a server in your building or is delivered as a service, falls squarely inside that scope. The measuring instrument on the bench was always a regulated article in your quality system. Now the software that governs that instrument’s calibration status is a regulated article in someone else’s.

This is a shift in where the obligation sits. Under the CRA the manufacturer of the product — the software vendor — carries the duties: security by design, a documented vulnerability-handling process across the product’s support period (a default of at least five years), the CE marking that will be mandatory when the Act fully applies on 11 December 2027, and, since 11 September 2026, active reporting. A manufacturer that becomes aware of an actively exploited vulnerability or a severe incident must file an early warning within 24 hours, a full notification within 72 hours, and a final report within 14 days, through ENISA’s Single Reporting Platform. That clock now runs on the tool holding your calibration evidence.

CRA is not NIS2 — and the difference matters to you

If you have already worked through NIS2, it is tempting to file this under the same heading. Do not. NIS2 (Directive (EU) 2022/2555) is about you as an operator — the security posture, governance, and incident reporting of essential and important entities. The CRA is about the product and its manufacturer. One regulates the organisation running the tool; the other regulates the tool itself. A manufacturer might operate a spotless NIS2 programme and still ship a product that fails the CRA, or vice versa. Your auditor, and increasingly your OEM customer, will treat them as two separate assurances.

The practical consequence is that a gap in your calibration software’s CRA posture is a supplier gap you inherit — not a box IT can tick on your behalf.

The worked example: the on-prem tool nobody is patching

Consider the legacy on-premise calibration database many teams still run — a Windows application over a local SQL instance, installed years ago, maintained by whoever is left. Ask three questions of it. Who supplies its security updates across a five-year support window? Who files the 24-hour early warning if a vulnerability in it is actively exploited? Who holds the CE conformity for it? If the honest answer is the original developer is gone, or we patch it ourselves when we remember, then you are not merely running unsupported software. You are effectively absorbing a manufacturer’s obligations you were never resourced to carry — the patch tax, the monitoring, the reporting — on the system that must survive your next surveillance audit.

A vendor-hosted, EU-native service inverts that. The obligation to design securely, to handle vulnerabilities across the support period, and to report within the CRA’s deadlines sits with the vendor, as part of the subscription, not with your quality department at 4pm on a Friday.

The objection: "that’s the vendor’s problem, not ours"

Formally, yes — the CRA duties fall on the manufacturer. But the exposure lands on you two ways. First, an auditor assessing your control of monitoring and measuring resources under ISO 9001 clause 7.1.5, IATF 16949, or the software-control expectations of ISO/IEC 17025, will reasonably ask how the tool of record is maintained and secured; "the vendor left in 2019" is not an answer that closes a finding. Second, your customers are already writing the CRA into their supplier questionnaires. A software product you cannot get a straight compliance answer about becomes a mark against your qualification, regardless of whose duty it technically is.

The vendor questions that changed

Before 11 September 2026, evaluating calibration software was a feature and data-residency conversation. Now, add these to the list:

• Do you treat this product as in scope of the CRA, and can you state that in writing?
• What is the declared support period, and what does your vulnerability-handling process look like across it?
• How do you meet the 24-hour / 72-hour / 14-day reporting duties, and how will we be notified of an incident affecting our data?
• Where is our calibration data hosted and processed, and does it stay in the EU?
• Can you provide a software bill of materials and a plan for CE conformity ahead of December 2027?

Where PrüfDesk fits

PrüfDesk is built as an EU-native calibration and precision-equipment system, hosted in the EU, delivered as a maintained service. That posture is the point: the product obligations the CRA places on a manufacturer sit with us, not with your quality team — while the calibration record itself keeps doing its job. Every instrument registered, every due date auto-calculated, every as-found/as-left result and certificate logged into one immutable possession and audit trail, ready for the next IATF 16949, AS9100, or ISO/IEC 17025 assessment.

You do not have to wait for a global vendor to arrive with a European answer, and you do not have to keep carrying a patch tax on a tool nobody maintains. If your next audit will ask how the system of record is secured and supported, that is a conversation worth having now — quietly, before the questionnaire does.

Want to see how PrüfDesk keeps your calibration evidence audit-ready on EU infrastructure? Take a look at the platform, or start with a single department.