CRA Copilot
The CRA Copilot is the chat in the right-hand panel (the sparkle icon). It answers questions about the Cyber Resilience Act, Article 14 reporting, your products and how to use Resilic — in German or English, in whichever language you write.
What it answers
Section titled “What it answers”- CRA duties and dates: Article 14 (reporting obligation since 11 September 2026), Article 13 / Annex I (full application from 11 December 2027), support periods, SBOM context.
- Adjacent regulation where it bears on the CRA: the Machinery Regulation (from 20 January 2027), NIS2, the product-side duties of the AI Act.
- Using Resilic: the product register and SBOMs, vulnerability correlation and triage, the
Article 14 workflow, the CVD policy, CSAF hosting and
security.txt, technical documentation, risk assessment, secure-by-design evidence, the customer portal and security passport, the AI register and AI literacy training, suppliers, Resilic Edge.
Anything else it declines in one sentence and names its scope. That is deliberate: an assistant with an opinion on everything is worthless on regulatory questions.
What it can see
Section titled “What it can see”The Copilot can read your own data when a question needs it — read only, your tenant only:
- your products with versions and support status,
- your fleet’s vulnerabilities,
- your reportable events and their deadlines,
- the state of your setup,
- this documentation.
It does not read advisories, risk assessments, AI register entries or Edge findings today; for those it points you to the respective screen. Names of components, customers or sites it sees along the way are treated as data, never as instructions.
What it never does
Section titled “What it never does”- It writes nothing. It does not declare, draft or file anything. If you want to report an event or draft a report from the chat, it offers at most one button that starts the normal flow — which you complete and approve yourself. AI drafts, a human signs.
- It certifies no conformity. It never tells you that you “are CRA compliant”; that is your conformity process. Statements about the law come with the source it cites.
- It does not overrule the law. Where the regulation is still moving — harmonised standards are not yet cited, the reporting platform’s field glossary is a living document — it says so and points to the primary source.
Limits
Section titled “Limits”The Copilot is an orientation aid, not legal advice. Its answers rest on a curated, version-controlled excerpt of the regulation and on this documentation; we maintain both, both can go stale. Verify statements about your duties against the regulation and your conformity process.
The Copilot uses an AI model from an external provider; the details of the processing are in the privacy policy. Whether it is enabled for your organisation, and with what budget, is governed by your plan and your AI settings; see Plans and trial.