ForgeCRA · For manufacturers
CRA makes you responsible for evidence you don't control.
ForgeCRA collects, quality-scores, and attests SBOMs from your suppliers — so your Cyber Resilience Act evidence chain doesn't live in your inbox.
Built by Simon Morley — repeat founder, infrastructure and security — inside PolkaSpots Ltd, which has been doing network and security work since 2005.
BOOK A 30-MINUTE PILOT CALLSuppliers send incomplete, outdated, or unusable SBOMs — when they send anything.
Full CRA obligations land 11 December 2027: SBOM, vulnerability handling, technical documentation. No size exemption.
The tools you may already own analyse what's on your network. They can't make a supplier send you evidence.
CRA penalties reach €15 million or 2.5% of worldwide annual turnover. That is why this has a budget line. It is not the reason to move now. The reason to move now is that supplier collection takes months, and December 2027 does not move.
We request structured SBOMs from your suppliers and chase them so you don't.
Structured requests to your suppliers, chased for you
Every submission is quality-scored against CRA / CISA minimum elements and signed as a supplier attestation.
Quality-scored against CRA / CISA minimum elements, signed and dated
Evidence stays current as components change — audit-ready when customers, auditors, or market surveillance ask.
Audit-ready evidence pack whenever it's asked for
Illustrative only. During pilots this workflow is run for you by hand — there is no self-serve platform yet.
ForgeCRA does not sell analysis, is not owned by anyone who does, and never resells supplier data.
That matters to you, not only to them. A supplier will not hand component detail to a vendor that also sells competitive analysis to their customers — which is why supplier data collection stalls when it is run by an analysis vendor or by a manufacturer directly. Neutrality is what makes the ask answerable.
E-invoicing had the same problem: every buyer wanted a different portal, and suppliers complied badly with all of them. Peppol solved it with one connection to many counterparties instead of bilateral integrations.
Peppol had a government mandate behind it. The CRA creates the same pressure on evidence without specifying the plumbing. That gap is what ForgeCRA is built for — and it is also the honest risk: nobody is mandating the network, so it has to earn its density.
We're selecting three design partners for a paid 90-day pilot (£5–15k depending on supplier count).
You get the full attestation workflow run for you; you shape the product; founding pricing locked for year one.
BOOK A 30-MINUTE PILOT CALL“We're building our own supplier portal.”
Then each supplier does the work once for you, and again for every other customer with a portal. Suppliers comply badly with work that does not compound — that is the pattern behind the SBOMs you are getting today. A neutral exchange lets a supplier publish once and share with all of you, which is the only version they have a reason to keep current.
“We already use ONEKEY / Finite State / similar.”
They analyse what you already hold. We get you what you don't hold. We complement them — several design partners will run both.
“Email works fine.”
At 20+ suppliers with a 24-hour reporting clock, email has no quality scoring, no attestation trail, and no update propagation. The pilot measures whether that's true for you.
“We're waiting for the harmonised standards.”
As of 19 August 2026, no CRA harmonised standard has been ratified or cited in the Official Journal, so no product category has a presumption of conformity. We map Annex I now and re-map automatically when they land. Supplier collection takes months — waiting is the expensive option.
At pilot start we record your current supplier response rate. That is the control.
Ninety days later there is a number to set against it, and the readout tells you plainly what happened rather than handing you a dashboard to interpret. Running this as a measured pilot rather than a licence is what makes that answer worth having.
If a call is easier later, tell us where you stand and we'll come back to you.
You're a supplier, not a manufacturer? This is your page →