Pomegra
CRACI, a Helsinki startup, raised €1.4M pre-seed from Lifeline Ventures to automate CRA compliance across software supply chains as EU enforcement begins.
Key Takeaways
- Lifeline Ventures led the €1.4M pre-seed; First Fellow Partners and Wave Ventures co-invested. Valuation was not disclosed.
- The EU Cyber Resilience Act's vulnerability-reporting obligations took effect September 11, 2026, binding over 600,000 companies worldwide.
- CRACI's platform integrates into CI/CD pipelines to track components, monitor vulnerabilities, and generate compliance documentation automatically.
Helsinki Startup Closes Pre-Seed With 112 Days to Spare
CRACI, a Helsinki-based software compliance startup, announced a €1.4 million pre-seed round in May 2026, led by Lifeline Ventures with participation from First Fellow Partners and Wave Ventures. The company was founded in 2025 by Juho Niemi, Dennis Marttinen, Jaakko Sirén, and Petteri Pulkkinen to build tooling for the EU's Cyber Resilience Act (CRA), which began imposing mandatory cybersecurity and vulnerability-reporting requirements on digital product makers this September. No valuation was disclosed.
The timing was pointed. The round closed 112 days before the CRA's enforcement date of September 11, 2026. That left a narrow runway to sign early customers and prove traction before the regulation stopped being a risk on a compliance calendar and started being a fines liability.
What Does CRACI's Platform Actually Do?
The product embeds into CI/CD pipelines - the automated workflows developers use to build, test, and ship software - and from there tracks every software component in the supply chain continuously. It monitors those components against known vulnerability databases, flags issues as they emerge, and generates the documentation packages regulators require for CRA compliance filings.
The core proposition is replacing periodic manual audits with continuous automated monitoring. For most organizations, that shift matters because the CRA extends accountability upstream: the regulation covers not just the finished application but the open-source libraries, third-party SDKs, and build tooling embedded in it. At scale, that dependency graph can run into thousands of components. Manual tracking at that volume has never been operationally practical.
Why Now, and Why Finland?
Lifeline Ventures leading the round carries some signal. The Helsinki-based fund has backed enterprise infrastructure companies including Aiven and Swappie and has a pattern of moving early on category-defining bets in Nordic B2B software. Backing CRACI at pre-seed, ahead of revenue, reads as a conviction that CRA compliance tooling is a durable category - not a one-cycle regulatory trade.
Finland's security ecosystem has developed a sharper-than-average institutional focus on cyber infrastructure, partly because of its geographical exposure and NATO alignment. That context shapes both the talent pool and the investor appetite for this type of company.
The €1.4 million figure sets clear expectations. Pre-seed rounds at this level typically fund 12 to 18 months of engineering and initial commercial exploration. CRACI has not disclosed revenue, customer count, or pipeline.
Is Single-Regulation Compliance a Real Business?
That is the structural question the company has to answer. The CRA is specific enough to create genuine new workflows - mandatory software bills of materials, defined vulnerability disclosure windows, direct reporting to ENISA - that do not map cleanly onto existing security tooling. That specificity is CRACI's opening.
The competitive pressure comes from well-capitalized incumbents. GitHub Advanced Security, Snyk, and enterprise security platforms already cover dependency scanning and vulnerability management at scale. The question is whether CRA-specific compliance workflows constitute a distinct enough product surface to sustain a standalone company, or whether existing vendors absorb the requirements in a routine platform update.
The regulation's penalty structure provides the strongest argument for urgency. Non-compliance carries fines up to €15 million or 2.5% of global annual turnover - a ceiling with more teeth than GDPR enforcement has typically produced in practice. That exposure should accelerate procurement even inside organizations that already have mature security programs.
Outlook
CRACI enters a live enforcement environment with capital deployed and a product aimed at obligations that are now binding. The €1.4 million pre-seed buys time to prove the market thesis before better-resourced competitors consolidate the space. The company's trajectory toward a Series A will depend on whether CRA compliance proves to be a structural workflow gap - or a feature that incumbent security vendors simply ship in their next quarterly release.
