Question 1

Does CRA actually apply to my SaaS product?

Accepted Answer

SaaS sits primarily under NIS2, not CRA — but CRA captures any "product with digital elements" you ship to the EU, including downloadable software, embedded firmware, and IoT. Most companies have at least one product in scope. We’ll establish that on day one of the engagement.

Question 2

Do you run CRA audits for companies based in Greece?

Accepted Answer

Yes — the team is based in Athens, and we run the audit remotely or on-site anywhere in Greece. The CRA is a directly applicable EU regulation, so Greek manufacturers face the same obligations and the same 11 September 2026 reporting deadline as everyone else in the single market, with no national transposition to wait for. In-scope Greek products cluster in marine and shipping tech, industrial IoT and hardware, defence, and payment devices. Working sessions run in Greek or English; deliverables are in English so they travel to boards, acquirers, and notified bodies. Worth noting: ENISA — the EU agency the CRA routes vulnerability reports through — is itself headquartered in Greece.

Question 3

We already use Snyk / Black Duck / GitHub Advanced Security. Why do I need this?

Accepted Answer

Those tools generate data. They don't tell you whether your engineering org can pass a regulatory audit, survive due diligence, or execute the remediation. That's the gap this audit fills. We'll work alongside whatever tooling you already have.

Question 4

What does "From €9,500" mean? When does it go up?

Accepted Answer

€9,500 covers a single product / single repo / team up to 15 engineers and 500K LOC. Multi-product orgs, monorepos over 1M LOC, or teams above 30 engineers move to €14,500 or €19,500 depending on scope. Quoted before signature, never after.

Question 5

How is this different from a traditional code audit or pen test?

Accepted Answer

A pen test finds vulnerabilities in production. A code audit assesses code quality. This audit is broader: it answers whether your engineering organisation — codebase, processes, people, and documentation — can pass CRA scrutiny and survive technical due diligence. It's an organisational assessment, not just a technical one.

Question 6

What do you need from us to start?

Accepted Answer

Read access to your primary code repositories, two hours of CTO/engineering lead time across the engagement, and one stakeholder interview each with security, product, and operations leads. We sign a mutual NDA before any access is granted.

Question 7

What happens after the readout?

Accepted Answer

You own the deliverables outright. About half of audits convert into a follow-up fractional CTO retainer to execute the remediation; the other half are handed back to internal teams. There's no obligation either way — the audit stands alone.

EU Cyber Resilience Act (CRA) Audit | Greece & EU