€1.4M+ · Software Supply Chain Compliance

What they're building

CRACI is a CI-integrated software supply chain platform that does three things the CRA requires and that no existing tool does together. First, it generates provably complete SBOMs (Software Bills of Materials) by building a continuously updated graph of every component, dependency, and transitive dependency across every product in your portfolio. Not a snapshot at build time. A live graph that updates as releases ship and as new vulnerabilities emerge against versions still in the field. Second, when a CVE drops, CRACI traces it upward through the graph to every affected product and release line, so the engineering team knows exactly what is exposed, in which version, across which products, within minutes rather than weeks. Third, it files the required ENISA vulnerability report automatically, before the CRA's 24-hour reporting clock runs out. The product positioning is precise: CRACI is your CI. Compliance ships with every build. The SBOM history is archived for as long as needed, covering the CRA's 10-year documentation retention requirement. Vulnerability handling lives in pull requests and issue trackers, not in a parallel compliance queue that engineers ignore. Hamina Wireless is already building with the platform.

Why this matters

The CRA comes into force in September 2026. From that date, every product with digital elements sold in the EU must meet a new cybersecurity baseline: proactive vulnerability handling, mandatory SBOM documentation, 24-hour reporting to ENISA when an actively exploited vulnerability is discovered, and 10 years of technical documentation retention after a product hits the market. The scope is enormous: over 600,000 companies worldwide are in scope. The penalty for non-compliance is loss of EU market access. The existing toolset is not adequate for this. Development-time scanners miss transitive dependencies that were clean at build but are not anymore. Manual compliance processes running on spreadsheets and Confluence pages work until a CVE drops at 11pm on a Friday and someone has 24 hours to file a report. The gap is not awareness. Every CISO CRACI has spoken to knows the deadline. What they do not have is the tooling that closes the loop from build to compliance without adding another manual process to their team's workflow. CRACI is building that tooling with a September 2026 hard deadline that makes every day of delay a commercial opportunity. Juho's founder quote is the product thesis compressed: "Those relying on manual approaches risk delays and higher costs." The CRA makes that risk explicit and financial, not just operational.