Something happened. When did you become aware?

The Cyber Resilience Act for a small software manufacturer, in twelve steps

Everything a ten-person company that ships installed software or a device has to do under the CRA, in the order to do it: the scope determination, the tier, the CSIRT and the enforcer, the reporting procedure that has applied since 11 September 2026, then the technical file, the 22 requirements, the SBOM, the support period, the CE mark and the declaration due by 11 December 2027.

Which CSIRT do you report to under the CRA? The coordinator for your main establishment, all 27 named

Article 14 sends the notification to the CSIRT designated as coordinator by the member state of your main establishment; ENISA published all 27 on 10 September 2026.

How to file a CRA notification on ENISA's platform: a personal EU Login, one coordinator, three tabs, no API

portal.cra-srp.enisa.europa.eu opened on 11 September 2026.

When does the CRA's 24-hour clock start? At a reasonable degree of certainty after a prompt initial assessment, per the Commission's guidance

Article 14 counts 24 and 72 hours from 'becoming aware' and never defines it.

The CRA final report clock does not start when you become aware

Most write-ups of Cyber Resilience Act Article 14 give three deadlines from one starting point: 24 hours, 72 hours, 14 days.

Is your product in scope of the Cyber Resilience Act? Where SaaS sits

The most-asked CRA question is not how to report, it is whether the Regulation applies to you at all.

When is software 'placed on the market' under the CRA, and which of your builds is a product? The guidance's rule for standalone software

Everything in the CRA hangs on a date and a noun: the date a product is placed on the market, and whether what you ship is a product at all.

Which parts of your backend are inside the CRA? Remote data processing, from the Commission's guidance

A product with digital elements includes its remote data processing solutions, and the Regulation defines them in one sentence.

Who enforces the Cyber Resilience Act in your member state? 7 of 27 have said

The CRA is enforced nationally, by a market surveillance authority each member state designates and registers with the Commission.

Is your product important or critical under the CRA? Default unless it is one of the 19, 4 or 3 categories of Annex III and IV

In scope of the CRA means default, important class I (19 categories), important class II (4) or critical (3), and the tier decides whether you self-assess or need a notified body under Article 32.

Default, important or critical: the 26 technical descriptions of Implementing Regulation 2025/2392, and the core-functionality test

Annex III and IV of the CRA name 26 product categories in a line each.

CRA Annex 1: the 22 essential requirements as a checklist, 14 product requirements and 8 for vulnerability handling

What your product must meet from 11 December 2027 and the technical file must show: Part I, 14 product requirements, 13 of them 'where applicable' on the basis of your risk assessment; Part II, 8 vulnerability-handling requirements that always apply.

What goes in the CRA technical file: Annex VII, point by point

From 11 December 2027 every product with digital elements placed on the EU market needs technical documentation before it is placed, kept for ten years or the support period, whichever is longer.

Does the CRA require an SBOM? Yes, and here is exactly what it says

Annex I, Part II, point 1 of the Cyber Resilience Act requires a software bill of materials in a commonly used, machine-readable format covering at least the top-level dependencies.

What the CRA asks of you for your dependencies: due diligence, reporting upstream, and known exploitable vulnerabilities, from the Commission's guidance

A software product is mostly other people's code.

CRA or NIS2: which one applies to a software company, and can it be both?

The Cyber Resilience Act regulates products placed on the market; NIS2 regulates entities that provide services.

NIS2 or CRA: which incident clock runs for a software company, and what makes an incident 'significant'

Both laws give you 24 hours, 72 hours and a month, and both start the clock when you 'become aware'.

Does software need a CE mark under the CRA? Yes, and Article 30 says where it goes

From 11 December 2027, a CE marking is required on every product with digital elements placed on the EU market, software included.

The EU declaration of conformity under the CRA: Annex V point by point, the simplified form, and a worked example

Article 28 makes the manufacturer draw up an EU declaration of conformity before the product is placed on the market, in the model structure of Annex V, and Article 28(4) makes signing it the act by which the manufacturer assumes responsibility for the product.

Self-assessment under the CRA: what module A actually requires, from Annex VIII and the Commission's FAQ

Most software products will never see a notified body.

Harmonised standards for the CRA: none cited yet, 41 requested, the first two were due 30 August 2026

Request M/606 of 3 February 2025 asks CEN, CENELEC and ETSI for 41 standards: two horizontal ones by 30 August 2026, the vertical ones for Annex III and IV products by 30 October 2026, the generic requirements by 30 October 2027.

How long is the CRA support period? At least five years, the end date shown at purchase, each update kept ten years

Article 13(8) of the Cyber Resilience Act: a support period of at least five years, or the expected time in use if shorter; its end date, at least month and year, stated at the time of purchase; each security update kept available for ten years or the remainder of the period; the technical file, the declaration and the user information kept ten years after placing on the market or for the support period.

Which update puts your existing software under the CRA? Substantial modifications, from the Commission's guidance

Software placed on the market before 11 December 2027 stays outside the CRA's design and conformity duties until it is substantially modified.

What you have to report under the CRA: the two triggers, as the Regulation defines them

Article 14 has two triggers and both are defined in the text.

Does the CRA apply to open-source software? Three cases, and the light regime for stewards

The Cyber Resilience Act reaches free and open-source software only when it is supplied in the course of a commercial activity.

Is your open-source project 'commercial' under the CRA? The Commission's seven tests, with its examples

The CRA reaches free and open-source software only where it is supplied in the course of a commercial activity, and the Regulation leaves 'commercial' to two recitals.

What the CRA asks of importers and distributors, and when it makes them the manufacturer

If you resell software or devices into the EU rather than build them, Articles 19 and 20 of the Cyber Resilience Act give you a checklist to run before the product goes on sale, a duty to pass vulnerabilities to the manufacturer, a duty to tell authorities about significant risks, and ten years of record-keeping.

The EU's own CRA machinery, on the day the duty started: 0 notified bodies, 0 harmonised standards, 7 of 27 enforcers

The Cyber Resilience Act asks manufacturers to be ready.

The CRA cybersecurity risk assessment: what Article 13 actually requires, and the one output it must produce

Article 13(2) to (4) of the Cyber Resilience Act make the risk assessment the document every other CRA obligation hangs off.

The coordinated vulnerability disclosure policy the CRA requires: three provisions, and a one-page policy that meets them

Annex I, Part II, point 5 of the Cyber Resilience Act requires every manufacturer in scope to put in place and enforce a coordinated vulnerability disclosure policy.