SCIOPTA Safety Certified Kernel – CRA Compliance Overview

Last updated: April 9, 2026

Introduction

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) establishes mandatory cybersecurity requirements for products with digital elements (PDEs) placed on the EU market. SCIOPTA has completed a comprehensive CRA compliance program to support manufacturers in meeting these requirements.

SCIOPTA provides three product families that support manufacturers in building CRA-compliant systems:

1. SCIOPTA Safety Certified Kernel: A deterministic, hard real-time operating system certified for safety-critical applications (IEC 61508 SIL3, EN 50128 SIL4, EN 50716 SIL3/4, ISO 26262 ASIL D).
2. SCIOPTA Standard Kernel: A deterministic, hard real-time operating system with the same architecture and features as the Safety Certified Kernel, but without functional safety certification.
3. SCIOPTA Middleware: Modular software components (IP stacks, file systems, USB stacks, CONNECTOR) that run on the Kernel.

The SCIOPTA Kernel (both Safety Certified and Standard) provides a secure, certified foundation for software systems, aligning closely with CRA requirements and helping customers accelerate compliance.

Key Dates

For Manufacturers Using SCIOPTA Components

Does the CRA apply to my product?

The CRA applies if you place a product with digital elements (PDE) on the EU market for commercial purposes. This includes hardware devices with embedded software and standalone software products unless the product falls under specific exclusions (e.g., individually negotiated contracts or sectoral legislation listed in Annex I, as detailed in Article 2(2)).

Which category does my product belong to?

The CRA classifies products into categories based on risk: Important Products (Annex III) and Critical Products (Annex IV). Products not listed in either annex are considered Default products and carry lower requirements.

Product Classification Guidance

A device using SCIOPTA components is classified based on its core functionality (e.g., making coffee, controlling a motor, securing a network), not on the presence of an RTOS or middleware.

Manufacturer Obligations

1. Classification of Your Final Product

Your product's CRA category depends on its core functionality (Article 7).

• Example A (Default): A medical infusion pump → Core function: delivering medication safely → Default product.
• Example B (Important - Class II): A network firewall appliance → Core function: network security → Important Product (Class II).

2. Your Obligations as an Integrator

Article 13 and Article 14 of the CRA set out the obligations that apply to all manufacturers of PDEs, regardless of classification. As an integrator of SCIOPTA components, your key obligations include:

• Cybersecurity risk assessment (Art. 13(2), Annex I Part I): Conduct and maintain a documented risk assessment covering your full product — including the SCIOPTA kernel, middleware, and your own application layers — throughout the product lifecycle.
• Due diligence on third-party components (Art. 13(5)): Verify that SCIOPTA components you integrate are free of known exploitable vulnerabilities at the time of integration. Use the SBOMs and component hashes SCIOPTA provides as part of this assessment.
• Vulnerability handling for the support period (Art. 13(6), Annex I Part II): Maintain a process to receive, triage, and remediate security vulnerabilities for a minimum of five years — or for the expected product lifetime if shorter. Security updates must be delivered to end users without undue delay.
• Incident and vulnerability reporting (Art. 14): Report actively exploited vulnerabilities and severe incidents affecting your final product to your national CSIRT coordinator and ENISA, within the 24/72-hour timelines. This obligation becomes enforceable on September 11, 2026.
• Technical documentation (Art. 31, Annex VII): Maintain a technical file covering design, risk assessment, testing evidence, and conformity assessment records. This must remain available to market surveillance authorities for at least ten years.
• Conformity assessment (Art. 32, Annex VIII): Complete the conformity assessment procedure applicable to your product's classification before placing it on the market.
• CE marking and Declaration of Conformity (Art. 28): Affix the CE mark and issue an EU Declaration of Conformity once the conformity assessment is successfully completed.

3. Obtaining an SBOM for Your Product

A machine-readable Software Bill of Materials (SBOM) is essential for demonstrating supply-chain transparency under Article 13(5) and for managing vulnerability exposure across your product's lifecycle. SCIOPTA provides a component-level SBOM for every kernel deliverable, including cryptographic hashes and a signed delivery manifest. Contact support@sciopta.com specifying your kernel version to receive the relevant SBOM package. SCIOPTA supports SPDX formats for integration with your existing toolchain.

How SCIOPTA Meets CRA Requirements

Secure-by-Design Architecture

• Message-based IPC: Eliminates shared memory, reducing attack surfaces.
• Deterministic Scheduling: Ensures predictable task execution.
• Module Separation: Kernel tasks and drivers are isolated to prevent unauthorized access.
• Memory Protection: MMU/MPU-based memory management enforces task isolation.

Data Integrity & Secure Delivery

• Digitally signed delivery: The entire kernel delivery package is signed using PGP/GPG.
• Secure download: HTTPS distribution with password via signed email.
• Component integrity: Strong hashes for every deliverable provided.
• SBOM included: SPDX-2.3 SBOM provided with every delivery.
• Runtime integrity: Built-in runtime checks of kernel components.

Resilience & Error Handling

• Centralized error hooks provide safe fault handling.
• Fail-safe recovery mechanisms maintain predictable operation after errors.
• Robust architecture minimizes the impact of vulnerabilities.

Vulnerability & Lifecycle Management

• Long-term support (≥5 years) for kernel versions.
• Security Vulnerability Management Process: monitoring, reporting, and patching.
• Certified development practices: MISRA-C coding guidelines and safety standards.

Documentation & Conformity Assessment

• Technical documentation includes architecture, design and risk assessment.
• Safety manuals and TÜV certificates provide evidence for conformity assessment.
• Supports CE marking activities with certified components.

User Information & Guidance

• Clear instructions for installation, configuration, and safe operation.
• Guidance on supported configurations, updates and residual risks.

Certification & Assurance

• TÜV SÜD-certified: IEC 61508 SIL3, EN 50128 SIL4 (soon EN 50716 up to SIL3/4), ISO 26262 ASIL D.
• Certification supports third-party conformity assessments, aligning with CRA requirements.

CRA Compliance Documentation (2026)

SCIOPTA has completed the following CRA compliance documentation:

• Incident Response Plan: Internal procedure for reporting actively exploited vulnerabilities and severe incidents to ENISA and CSIRT within the required 24/72-hour timelines (Article 14).
• Support Period Justification: Formal documentation of the 5-year minimum support period for SCIOPTA Kernels, including the rationale based on expected product lifetime, customer expectations, and regulatory requirements (Article 13(8)).
• SBOM Documentation: SPDX-2.3 Software Bill of Materials provided with every kernel delivery.
• Safety Manual Update (v3.3): Reviewed and corrected the Safety Manual.

Substantial Modification Guidance

Under the CRA, a substantial modification is a change to a product after its placing on the market that affects its compliance with the CRA or modifies its intended purpose. This is important because a substantial modification means the product is treated as newly placed on the market and may require a new conformity assessment.

SCIOPTA provides guidance to help integrators determine whether a kernel update constitutes a substantial modification, based on the Commission guidance published on 27 July 2026 and Recitals 39-41 of the CRA.

Decision Framework:

Integrator Responsibility: Integrators remain responsible for determining whether a kernel update constitutes a substantial modification in the context of their final product. For detailed guidance, refer to the Substantial Modification Guidance.

CRA Compliance Documentation (2026)

SCIOPTA has completed the following CRA compliance documentation:

• Incident Response Plan: Internal procedure for reporting actively exploited vulnerabilities and severe incidents to ENISA and CSIRT within the required 24/72-hour timelines (Article 14).
• Support Period Justification: Formal documentation of the 5-year minimum support period for SCIOPTA Kernels, including the rationale based on expected product lifetime, customer expectations, and regulatory requirements (Article 13(8)).
• SBOM Documentation: SPDX-2.3 Software Bill of Materials provided with every kernel delivery.
• Safety Manual Update (v3.3): Reviewed and corrected the Safety Manual.
• Substantial Modification Guidance: Framework for integrators to assess whether kernel updates require re-assessment of conformity.

Conclusion

SCIOPTA products are developed using secure-by-design principles, certified safety processes, and a transparent vulnerability management framework. This provides a strong, verifiable foundation for manufacturers to build products that comply with the EU Cyber Resilience Act.

For the full technical documentation, including detailed mapping to CRA Annexes, please contact us at support@sciopta.com.