A software bill of materials
A machine-readable list of the components in each release, covering at least the top-level dependencies.
EU Cyber Resilience Act · Applies in full from 11 December 2027
CRA compliance for every mobile app you maintain.
Shipmark keeps an up-to-date inventory of the components inside your clients’ Flutter, React Native and native apps, checks them for known vulnerabilities every day, and drafts the documentation the regulation requires. Your team only reviews and signs off.
Built for agencies of 2 to 50 people. We are onboarding early-access agencies in small groups.
Orderly for iOSrelease 4.2.0 · client: Trattoria Lume
- Software bill of materialsCycloneDX 1.6312 components
- Known vulnerabilitiesOSV · EU Vulnerability Database2 to review
- Actively exploitedCVE-2026-31337 · networking library1 found
ENISA early warning due in
21:14:09
Report text prepared. Submit it through ENISA’s Single Reporting Platform.
- Technical fileAnnex VII6 of 8 sections ready
- Security updates promised untilMarch 2031
In force
Since 11 September 2026
24-hour reporting
Manufacturers must report actively exploited vulnerabilities and severe security incidents through ENISA’s Single Reporting Platform.
Upcoming
11 December 2027
404 days left
All essential cybersecurity requirements apply to products on the EU market.
Penalties
Maximum fine
€15M or 2.5%
Of worldwide annual turnover, whichever is higher, for breaching the essential requirements.
What the regulation asks
Four obligations for every app your clients publish.
The CRA covers software sold or distributed in the EU as part of a commercial activity. That includes most mobile apps, even free ones published by a company.
Vulnerability handling and updates
Track known vulnerabilities, fix them without delay and provide security updates for the whole support period, which is generally at least five years.
Reporting to ENISA
When a vulnerability is actively exploited: an early warning within 24 hours, a notification within 72 hours and a final report within 14 days of a fix being available.
Technical documentation
A technical file and an EU declaration of conformity, kept for ten years or for the support period, whichever is longer.
Summarised from Regulation (EU) 2024/2847. This is a summary, not legal advice.
How it works
From lockfile to declaration in three steps.
-
01 · Connect
Point Shipmark at your repositories
Install the GitHub or GitLab app, or add a single step to your CI pipeline. Shipmark reads dependency manifests and lockfiles. It never needs your source code.
pubspec.lockpackage-lock.jsonyarn.lockPodfile.lockPackage.resolvedgradle.lockfile -
02 · Monitor
Know the day a component turns risky
Each release gets a CycloneDX SBOM. Every day, Shipmark checks each component against public vulnerability databases. If a vulnerability is being exploited, it starts the 24-hour and 72-hour clocks and prepares the text for ENISA.
-
03 · Document
Get the paperwork drafted
Shipmark drafts the technical file, the security information for users and the EU declaration of conformity. Nothing is final until someone on your team has reviewed and approved it.
For agencies
One dashboard for every client app.
Agencies often maintain dozens of apps for clients, many of whom have never heard of the CRA. Shipmark lets you cover all of them from one place and offer compliance as part of your maintenance contracts.
- Every client app, release and SBOM in one list
- Alerts sent to the right project by email or Slack
- Client-ready reports with your agency’s branding
- Evidence kept for ten years and exportable per app
| App | Stack | Status |
|---|---|---|
| Orderly for iOSTrattoria Lume | Swift | Exploited · act now |
| Orderly for AndroidTrattoria Lume | Kotlin | Up to date |
| Pulse FitnessForma Studio | Flutter | 2 to review |
| CityCareClinica Nordica | React Native | Up to date |
| BooklyAtelier Verde | Flutter | Docs 6 of 8 |
Clear boundaries
What Shipmark is not.
Not a certificate
Shipmark helps you prepare and keep the evidence. The manufacturer of the app remains responsible for its conformity.
Not legal advice
For questions about your specific contracts or obligations, speak to a lawyer.
Not a code scanner
Shipmark looks at the components your apps depend on, not at the code your team writes.
Pricing
Indicative pricing.
Final prices will be set together with our early-access agencies. All prices are per month and exclude VAT.
Solo
€49 / month
For freelancers and small teams with up to 3 apps.
- SBOM for every release
- Daily vulnerability checks
- ENISA reporting assistant
- Draft documentation
Agency
Recommended€149 / month
For agencies maintaining up to 15 apps.
- Everything in Solo
- Branded reports for clients
- Alerts per project by email or Slack
- Access for your whole team
Studio
Let’s talk
For agencies maintaining more than 15 apps.
- Everything in Agency
- Volume pricing
- Help with onboarding your portfolio
Questions
Frequently asked questions.
Are our clients’ apps covered by the CRA?
Most likely, yes. The CRA applies to software made available on the EU market as part of a commercial activity, including free apps published by companies. Purely web-based services without an installable component are generally outside its scope.
Who is responsible: the agency or the client?
Usually the party that places the app on the market under its own name, which is often your client. Contracts differ, so check yours. Shipmark is designed so that an agency can do the work on its clients’ behalf.
Do you need access to our source code?
No. Shipmark only needs dependency manifests and lockfiles, which list the components an app uses.
Is Shipmark legal advice?
No. Shipmark helps you organise the technical work and keep the evidence. It does not replace advice from a lawyer.
When can we start?
We are onboarding agencies in small groups. Join the early-access list and we will contact you personally.
Early access
Get your agency ready before the deadline.
Tell us a little about your agency. We read every request and reply personally.
Prefer email? Write to catalin@shipmark.eu.