Now in force . Reporting duties apply since 11 Sep 2026.
Tell us what you sell. We tell you what applies to it, and when.
Example data
- Who it applies to
- Any manufacturer, importer or distributor of a product with digital elements placed on the EU market, software included, with no size threshold.
- The dates
- The reporting duty of Article 14 has applied since 11 September 2026, and the rest of the Regulation applies from 11 December 2027.
- The one thing to do
- Decide whether each product you place on the market is in scope, write the determination down, and set the reporting route up before you need it.
Notified bodies
Chapter IV: conformity assessment bodies can be notified from this date.
Reporting duty
Article 14: actively exploited vulnerabilities and severe incidents are reported from this date, 24 hours for the early warning.
Everything else
The essential requirements, the technical file and the CE marking apply to every product placed on the market from this date.
At a glance
111requirements, each with the provision it rests on
67mapped to ISO clauses or controls
8start a deadline clock
The reporting chain of Article 14(2)
Send the vulnerability early warning within 24 hours
14(2)(a)
Send the vulnerability notification within 72 hours
14(2)(b)
Send the final report 14 days after the fix
14(2)(c)
The Cyber Resilience Act, for a software manufacturer
The Cyber Resilience Act reaches every product with digital elements placed on the EU market: the Article 14 reporting duty since 11 September 2026, the rest from 11 December 2027.
Answer above to read the determination for your case; the full tool takes your answers with it.
Continue in the free determinationThe full determination answers every question, and keeps the reading as a dated record for €29.
CRA technical file, done for you: €2,900
The pack's 11 documents, filled for your product.
Seven tools, free, no account
- Free checkIs your product in scope, and which tier?Six questions from Article 2, Article 3, Recital 12 and Annexes III and IV, with the technical description of each category and the coordinator for your member state.
- Free checkEvery obligation, by roleThe 111 rows of the Regulation that bind a manufacturer, an importer, a distributor or an open-source steward, in the Official Journal's words, with a status per row and the checklist written as a document.
- CalculatorThe Article 14 deadline calculatorThe 24-hour, 72-hour and final-report deadlines for both triggers, with the final report anchored where the Regulation anchors it, the CSIRT coordinators of all 27 states, and the enforcers register.
- GuideWhere to report, by member statePick the state of your main establishment and read the CSIRT designated as coordinator, its contact page and the three clocks; one row per member state from ENISA's list, with the date it was read.
- GuideThe technical file, Annex VII point by pointWhat the file must contain, how many of the 22 essential requirements a class I product must document against a harmonised standard that does not yet exist, and what StandardOS assembles.
- MappingAnnex I mapped to ISO 27001Each of the 22 essential requirements against the Annex A controls that run the process behind it, and the ones nothing in Annex A produces: the SBOM, public disclosure, the disclosure policy, free updates.
- GuideImporters and distributorsThe duties of Articles 19 to 21 for a company that resells or imports a product with digital elements, and the checks that satisfy them.
- Free checkConnected consumer devicesA device a household buys: in scope by default, and five categories singled out in Annex III class I.
- Free checkIndustrial and connected equipmentA machine, drive, controller or sensor is default class; what Annex III lists is the network and security layer around it.
- Free checkEmbedded software and firmwareSoftware that ships inside someone else's product is its own product with digital elements, and there is no open-source exemption.
- Free checkSoftware you installSoftware placed on the market carries a CE mark, on the declaration or the website. If customers only log in, Recital 12 points to NIS2.
Every free template on one page
Three dates
- Applies11 June 2026
Chapter IV: the rules for notified bodies, so that the conformity assessment bodies for important and critical products can be designated. None had been on 13 October 2026.
- Applies11 September 2026
Article 14: an actively exploited vulnerability or a severe incident starts a 24-hour early warning, a 72-hour notification and a final report, filed on ENISA's single reporting platform. Every product in scope, including those already on the market.
- Applies from11 December 2027
Full application: the essential requirements of Annex I, the conformity assessment, the technical file, the CE mark and the support period, for every product placed on the market from that day, and for older products once they are substantially modified.
The CRA and the AI Act, since 27 July 2026
A product with digital elements can also be a high-risk AI system under Article 6 of the AI Act. Article 12(1) of the CRA, and since 27 July 2026 Article 42(3) of the AI Act as amended, deem such a system to comply with the AI Act's cybersecurity requirements of Article 15 where the product meets the Annex I Part I requirements, the manufacturer's processes meet Part II, and the level of protection is demonstrated in the CRA EU declaration of conformity. One conformity assessment, under Article 43 of the AI Act, covers both.
Is your product also a high-risk AI system? The determination, free
32 articles, from the primary sources
Does it apply to you, and how much
- ArticleIs your product in scope of the Cyber Resilience Act? Where SaaS sitsThe most-asked CRA question is not how to report, it is whether the Regulation applies to you at all.
- ArticleWhen is software 'placed on the market' under the CRA, and which of your builds is a product? The guidance's rule for standalone softwareEverything in the CRA hangs on a date and a noun: the date a product is placed on the market, and whether what you ship is a product at all.
- ArticleWhich parts of your backend are inside the CRA? Remote data processing, from the Commission's guidanceA product with digital elements includes its remote data processing solutions, and the Regulation defines them in one sentence.
- ArticleCRA or NIS2: which one applies to a software company, and can it be both?The Cyber Resilience Act regulates products placed on the market; NIS2 regulates entities that provide services.
- ArticleDoes the CRA apply to open-source software? Three cases, and the light regime for stewardsThe Cyber Resilience Act reaches free and open-source software only when it is supplied in the course of a commercial activity.
- ArticleIs your open-source project 'commercial' under the CRA? The Commission's seven tests, with its examplesThe CRA reaches free and open-source software only where it is supplied in the course of a commercial activity, and the Regulation leaves 'commercial' to two recitals.
- ArticleIs your product important or critical under the CRA? Default unless it is one of the 19, 4 or 3 categories of Annex III and IVIn scope of the CRA means default, important class I (19 categories), important class II (4) or critical (3), and the tier decides whether you self-assess or need a notified body under Article 32.
- ArticleDefault, important or critical: the 26 technical descriptions of Implementing Regulation 2025/2392, and the core-functionality testAnnex III and IV of the CRA name 26 product categories in a line each.
- ArticleWhat the CRA asks of importers and distributors, and when it makes them the manufacturerIf you resell software or devices into the EU rather than build them, Articles 19 and 20 of the Cyber Resilience Act give you a checklist to run before the product goes on sale, a duty to pass vulnerabilities to the manufacturer, a duty to tell authorities about significant risks, and ten years of record-keeping.
- ArticleWhich update puts your existing software under the CRA? Substantial modifications, from the Commission's guidanceSoftware placed on the market before 11 December 2027 stays outside the CRA's design and conformity duties until it is substantially modified.
Reporting, since 11 September 2026
- ArticleWhat you have to report under the CRA: the two triggers, as the Regulation defines themArticle 14 has two triggers and both are defined in the text.
- ArticleWhen does the CRA's 24-hour clock start? At a reasonable degree of certainty after a prompt initial assessment, per the Commission's guidanceArticle 14 counts 24 and 72 hours from 'becoming aware' and never defines it.
- ArticleWhich CSIRT do you report to under the CRA? The coordinator for your main establishment, all 27 namedArticle 14 sends the notification to the CSIRT designated as coordinator by the member state of your main establishment; ENISA published all 27 on 10 September 2026.
- ArticleHow to file a CRA notification on ENISA's platform: a personal EU Login, one coordinator, three tabs, no APIportal.cra-srp.enisa.europa.eu opened on 11 September 2026.
- ArticleThe CRA final report clock does not start when you become awareMost write-ups of Cyber Resilience Act Article 14 give three deadlines from one starting point: 24 hours, 72 hours, 14 days.
- ArticleNIS2 or CRA: which incident clock runs for a software company, and what makes an incident 'significant'Both laws give you 24 hours, 72 hours and a month, and both start the clock when you 'become aware'.
- ArticleWho enforces the Cyber Resilience Act in your member state? 7 of 27 have saidThe CRA is enforced nationally, by a market surveillance authority each member state designates and registers with the Commission.
- ArticleThe EU's own CRA machinery, on the day the duty started: 0 notified bodies, 0 harmonised standards, 7 of 27 enforcersThe Cyber Resilience Act asks manufacturers to be ready.
- ArticleCyber Resilience Act penalties: what a small manufacturer is actually exposed toThe CRA sets three fine tiers, up to EUR 15 million or 2.5% of worldwide turnover.
Building the file, by 11 December 2027
- ArticleThe Cyber Resilience Act for a small software manufacturer, in twelve stepsEverything a ten-person company that ships installed software or a device has to do under the CRA, in the order to do it: the scope determination, the tier, the CSIRT and the enforcer, the reporting procedure that has applied since 11 September 2026, then the technical file, the 22 requirements, the SBOM, the support period, the CE mark and the declaration due by 11 December 2027.
- ArticleCRA Article 13 for a software manufacturer: the twenty-five paragraphs in order, which are yours, which are the Commission's, and a checklist by roleArticle 13 of the Cyber Resilience Act is the manufacturer's article: twenty-five paragraphs from the essential requirements of paragraph 1 to the Commission's powers of paragraph 25.
- ArticleSelf-assessment under the CRA: what module A actually requires, from Annex VIII and the Commission's FAQMost software products will never see a notified body.
- ArticleHarmonised standards for the CRA: none cited yet, 41 requested, the first two were due 30 August 2026Request M/606 of 3 February 2025 asks CEN, CENELEC and ETSI for 41 standards: two horizontal ones by 30 August 2026, the vertical ones for Annex III and IV products by 30 October 2026, the generic requirements by 30 October 2027.
- ArticleCRA Annex 1: the 22 essential requirements as a checklist, 14 product requirements and 8 for vulnerability handlingWhat your product must meet from 11 December 2027 and the technical file must show: Part I, 14 product requirements, 13 of them 'where applicable' on the basis of your risk assessment; Part II, 8 vulnerability-handling requirements that always apply.
- ArticleThe CRA cybersecurity risk assessment: what Article 13 actually requires, and the one output it must produceArticle 13(2) to (4) of the Cyber Resilience Act make the risk assessment the document every other CRA obligation hangs off.
- ArticleWhat goes in the CRA technical file: Annex VII, point by pointFrom 11 December 2027 every product with digital elements placed on the EU market needs technical documentation before it is placed, kept for ten years or the support period, whichever is longer.
- ArticleDoes the CRA require an SBOM? Yes, and here is exactly what it saysAnnex I, Part II, point 1 of the Cyber Resilience Act requires a software bill of materials in a commonly used, machine-readable format covering at least the top-level dependencies.
- ArticleWhat the CRA asks of you for your dependencies: due diligence, reporting upstream, and known exploitable vulnerabilities, from the Commission's guidanceA software product is mostly other people's code.
- ArticleThe coordinated vulnerability disclosure policy the CRA requires: three provisions, and a one-page policy that meets themAnnex I, Part II, point 5 of the Cyber Resilience Act requires every manufacturer in scope to put in place and enforce a coordinated vulnerability disclosure policy.
- ArticleHow long is the CRA support period? At least five years, the end date shown at purchase, each update kept ten yearsArticle 13(8) of the Cyber Resilience Act: a support period of at least five years, or the expected time in use if shorter; its end date, at least month and year, stated at the time of purchase; each security update kept available for ten years or the remainder of the period; the technical file, the declaration and the user information kept ten years after placing on the market or for the support period.
- ArticleDoes software need a CE mark under the CRA? Yes, and Article 30 says where it goesFrom 11 December 2027, a CE marking is required on every product with digital elements placed on the EU market, software included.
- ArticleThe EU declaration of conformity under the CRA: Annex V point by point, the simplified form, and a worked exampleArticle 28 makes the manufacturer draw up an EU declaration of conformity before the product is placed on the market, in the model structure of Annex V, and Article 28(4) makes signing it the act by which the manufacturer assumes responsibility for the product.
What it asks of you
111 requirements in 5 groups
Obligations
18- 13(1) Design, develop and produce the product to Annex I
- 13(2) Assess the product's cybersecurity risks and act on them
- 13(5) Check third-party components before integrating them
and 15 more
Duties
53- 13(3) Document the risk assessment and keep it current
- 13(4) Put the risk assessment in the technical documentation
- 13(6) Report a component vulnerability to its maintainer
and 50 more
Controls
22- I.1 Secure the product in proportion to its risks
- I.2.a Ship without known exploitable vulnerabilities
- I.2.b Ship secure by default, resettable to that state
and 19 more
Clauses
10- 13(8)-4 Watch for a category minimum set by delegated act
- 14(5) Judge an incident severe by its effect on security
- 18(1) You may appoint an authorised representative in writing
and 7 more
Deadlines
8- 14(2)(a) Send the vulnerability early warning within 24 hours
- 14(2)(b) Send the vulnerability notification within 72 hours
- 14(2)(c) Send the final report 14 days after the fix
and 5 more
The CRA file and the reporting clock, in one place
The CRA's requirements as a catalogue, the technical file built from them and the reporting clock, in one workspace.
Dates are read from the Regulation's Article 71 and never typed on this page. This is not legal advice, and the Regulation is the text to read: Regulation (EU) 2024/2847.
Related:The CRA for consultants and their clientsEuropean Accessibility ActProduct Liability DirectiveArticlesFree tools