Cyber Resilience Act with AI: what an MCP server can do for manufacturers

What does the Cyber Resilience Act require of manufacturers?

The Cyber Resilience Act, Regulation (EU) 2024/2847, covers products with digital elements: software and hardware, together with the data processing at a distance that the manufacturer develops for them and without which the product could not perform one of its functions (Art. 3(1) and (2)).

Its duties fall mainly on the manufacturer. That is whoever develops or manufactures such products, or has them developed or manufactured, and markets them under its own name or trademark (Art. 3(13)). One example is a company that sells its own software or a connected device.

For vulnerability handling, Annex I Part II lists eight duties, among them: document components and vulnerabilities, remediate without delay, disclose fixed vulnerabilities and give a contact address for reports. This holds for the support period, as a rule at least five years (Art. 13(8)).

Art. 3(1), (2) and (13), Art. 13(8), Annex I Part II CRA

What is an SBOM under the CRA, and who gets it?

The SBOM (software bill of materials) is a formal record of the components in a product's software and their supply chain relationships (Art. 3(39)). The manufacturer draws it up in a commonly used, machine-readable format covering at the very least the top-level dependencies (Annex I Part II(1)).

The Regulation names no particular format; the Commission may set the format and elements by implementing acts (Art. 13(24)). The SBOM is part of the technical documentation, which the manufacturer keeps available for at least ten years (Art. 13(13), Annex VII).

The manufacturer does not have to publish it. Whether users get it is the manufacturer's choice (Annex II(9)). A market surveillance authority receives it on a reasoned request, where it needs it to check compliance (Annex VII(8)).

Art. 3(39), Art. 13(13) and (24), Annex I Part II(1), Annex II(9), Annex VII CRA

Which reporting deadlines apply since 11 September 2026?

Manufacturers report actively exploited vulnerabilities and severe incidents affecting the security of the product, including for products already on the market before 11 December 2027 (Art. 69(3)). A vulnerability is actively exploited when there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission (Art. 3(42)).

For a vulnerability: an early warning within 24 hours of the manufacturer becoming aware of it and a notification within 72 hours. The final report follows no later than 14 days after a corrective or mitigating measure is available. For an incident the same 24 and 72 hours apply, and the final report follows within one month of the notification.

Reports go through ENISA's single reporting platform, simultaneously to the CSIRT designated as coordinator and to ENISA (Art. 14(1) and (7), Art. 16). A CSIRT is a computer security incident response team designated by a Member State; as a rule it is the one in the country of the manufacturer's main establishment. The manufacturer also informs the impacted users (Art. 14(8)).

Art. 3(42), Art. 14, Art. 16, Art. 69(3) CRA

What an AI assistant can do for manufacturers

MCP (Model Context Protocol) is an open standard that lets an AI assistant such as Claude or Copilot use another program. An MCP server is a program's connection for it. For the work below the assistant needs access to your development tools, for example through their MCP servers where the vendor offers one.

An assistant that works in the place where your source code is kept (the code repository) can have the SBOM generated for every new version and check that it matches what you ship. Our course “CRA SBOM Fundamentals” shows which formats exist and which tools generate an SBOM.

It matches the SBOM against published vulnerabilities, for example in ENISA's European vulnerability database, and prepares the hits for a person. It drafts the notes on fixed vulnerabilities (Annex I Part II(4)) and the message to the maintainer of an affected component (Art. 13(6)).

For a report it prepares what Art. 14(2) lists: the product concerned, the nature of the exploit, the measures taken and what users can do themselves.

What the manufacturer decides itself

The Regulation addresses these duties to the manufacturer. It does not say who in the company decides.

The EU declaration of conformity, a document the manufacturer draws up, states that meeting the requirements of Annex I has been demonstrated. With it the manufacturer assumes responsibility for its product (Art. 28(1) and (4)). With the CE marking on the product it indicates that the product and its processes meet those requirements (Art. 3(31)).

Several steps are judgements: whether the evidence of exploitation is reliable, how long the support period is, and whether information on a fixed vulnerability is published later in duly justified cases. An assistant supplies the material. We recommend that a person who may act for the manufacturer decides.

Art. 3(31), Art. 13(8), Art. 28(1) and (4), Annex I Part II(4) CRA

What nisd2.eu covers here

The nisd2.eu MCP server fills in only the NIS 2 walkthrough; once an admin allows it, it also reads the company's records for someone who may export, the vulnerability and patch registers included. It keeps no SBOM, reports nothing to ENISA and records no CRA obligations.

It helps on the buyer's side. NIS 2 requires security when you acquire your IT, including vulnerability handling (Art. 21(2)(e)). The CRA gives you facts to ask for. For products placed on the market from 11 December 2027, the manufacturer states the end of the support period at the time of purchase, at least month and year (Art. 13(19)). The product also comes with a point of contact for reporting vulnerabilities (Annex II(2)).

Art. 21(2)(e) NIS 2 · Art. 13(19), Annex II(2) CRA