CRACI Lands €1.4M to Automate CRA Compliance

The big picture: CRACI, based in Helsinki, has secured €1.4 million in pre-seed funding led by Lifeline Ventures, with support from First Fellow Partners and Wave Ventures. The startup helps software companies meet new legal requirements by automating vulnerability tracking and documentation. CRACI builds software that works with existing development pipelines to track vulnerabilities, generate security documentation, and manage software components throughout their lifecycle.

Why it matters:

• Regulatory Impact: The EU’s Cyber Resilience Act (CRA), starting in September 2026, will affect over 600,000 companies worldwide, including those outside Europe selling into the EU.
• Compliance Risk: Non-compliance with CRA standards for security, documentation, and ongoing vulnerability management can lead to significant fines of up to €15 million.
• Competitive Edge: Companies that invest early in CRA compliance gain a competitive advantage through faster market access and stronger trust, while manual approaches risk delays and higher costs.

How it works:

• CI/CD Integration: CRACI’s platform connects directly to existing CI/CD pipelines, integrating compliance checks alongside regular development instead of as a separate audit.
• Automated Tracking: When a team adds a new open-source library, CRACI tracks it, flags known vulnerabilities, and automatically updates the product’s security documentation.
• Comprehensive Compliance: The platform covers the full compliance workflow, including documentation, traceability records, and incident reporting, extending beyond just vulnerability detection.

The catch: Established vulnerability scanning tools like Snyk, Mend.io, and Black Duck are also adapting to meet CRA requirements. CRACI must demonstrate its comprehensive compliance workflow provides a distinct, scalable advantage over these entrenched players, especially as the market for regulatory automation becomes increasingly competitive.