Acuna GRC core
ComplyFrameworks, scopes and cross-mapping.ImplementRequirements, measures and controls.OperateRisks, tasks, annual plan, documents.AssureKPIs, audits and corrective actions.
Platform overview
Add-on modules
TPRM (Supplier Shield)Supplier assessments and a daily grade.Data PrivacyProcessing activities, DPIAs and requests.Cookie ManagerCookie banner and consent records.Trust CenterAnswer questionnaires, share a trust page.AI GovernanceRegister and assess your AI systems.EvaluationsSpot checks and gap assessments.Group managementSubsidiaries in one Group Compliance view.Staff PortalPolicies staff read and acknowledge.Vulnerability managementScanner results turned into issues.
All modules
Across the platform
AikoThe AI assistant, at your pace.Integrations and APIConnectors, task sync, webhooks, API.Administration and securityUsers, access profiles, audit log.100+ connectors
By size
StartupGet ready for your first audit.Mid-marketKeep the library clean as you grow.EnterpriseControl at scale.Consultants and MSSPsAll your clients in one view.
By framework
ISO 27001ISO 42001NIS2EU AI ActDORASOC 2GDPRNIST CSFSwiss FADPFINMA
See all frameworks
By need
Prepare for a certification auditAnswer a client questionnaireRun compliance across a groupAssess your suppliersGovern your AI systems
All solutions
Acuna GRC Services
Do it yourselfYou run the program in Acuna GRC, with Aiko.Done with you (Co-managed)Guidance, reviews and audit preparation with your team.Done for you (Fully managed)Our experts run it. You review.
What we take on
CISO as a serviceDPO as a serviceAudit preparationGap assessmentsProgram setup in Acuna GRC
Meet the experts
Alexis HirschhornCertified Lead AuditorLaura MenetreyLegal and privacy expertBénédicte SévinISO 27001 Lead Implementer
Meet the full team
MSSPs and consultants
Acuna GRC for MSSPsWhite label and tenant managementBecome a partner expert
Learn
BlogWebinarsAnswersGlossary
See all resources
Framework guides
ISO 27001NIS2DORAEU AI ActCyber Resilience Act
All frameworks
Featured
WebinarFrom AI hype to AI reality: governing the AI your company already usesView the webinarGuideHigh-risk AI systems: how the EU AI Act classifies yoursRead the guide
Company
About AcunaTeamPricingOur Trust CenterContact us
Legal
PrivacyTermsData Processing AgreementAcuna GRC AI information
Our own standard
ISO/IEC 27001:2022 certifiedThe standard you ask of your own suppliers.Built and run from SwitzerlandHosted in Switzerland, the EU or the US.
Cyber Resilience Act

How does the Cyber Resilience Act affect small businesses?

By Alexis Hirschhorn, CEO, AcunaLast updated 16 July 20262 min read

Direct answer

Small businesses that make products with digital elements are covered by the Cyber Resilience Act, but it includes proportionality measures: microenterprises and small enterprises can use simplified technical documentation, and the Commission and Member States must provide guidance and support. The core duties, secure design, vulnerability handling and reporting, still apply.

Key takeaways

  • SMEs and microenterprises that place products on the market are in scope.
  • Article 33(5): micro and small enterprises may provide their technical documentation (Annex VII) in a simplified format, which notified bodies are required to accept.
  • The Commission and Member States must provide SME support measures including regulatory sandboxes and dedicated communication channels (Art. 33).
  • Micro and small enterprises are exempt from fines for missing the 24-hour early warning deadline; all other obligations remain.
  • Reporting from 11 September 2026 applies regardless of company size, and the 72-hour notification + final report obligations are not waived.

The full answer

The CRA applies to small businesses that manufacture products with digital elements, but it is built with proportionality in mind.

Simplified technical documentation. Under Article 33(5), micro and small enterprises may provide their technical documentation (Annex VII) in a simplified format, and notified bodies are required to accept that format. This reduces the administrative burden of demonstrating conformity without waiving any substantive security requirement.

SME support measures. Article 33 directs the Commission and Member States to provide tailored support including regulatory sandboxes, dedicated communication channels, and sector-specific guidance. These measures are mandated, not discretionary.

Fine exemption for the 24-hour early warning. Micro and small enterprises are exempt from administrative fines for missing the 24-hour early warning deadline specifically. The 72-hour notification and the final report are not covered by this exemption -- those obligations and their fines remain in full force.

What proportionality does not do is waive the substance. A small manufacturer still has to design securely, run a vulnerability-handling process, maintain an SBOM, and submit a timely 72-hour notification. The reporting obligation from 11 September 2026 applies regardless of company size, which is why the practical advice for a small team is the same as for a large one: build the detection and escalation process before the deadline.

How Acuna GRC handles it

Sources

  1. CRA Article 33 (support for SMEs and microenterprises)
  2. European Commission -- CRA implementation

This page explains the rules in general terms and is not legal advice.

See how Acuna GRC runs this.

Tell us your frameworks and your team. We show you how Acuna GRC runs the program.

Hosted in Switzerland, the EU or the US