CRA guides
Practical explanations of the Cyber Resilience Act reporting obligations and technical file. Every statement is checked against the Regulation, ENISA's platform documentation or the Commission's guidance. Free to read.
Start here
- What Is the Cyber Resilience Act? A Plain-Language Introduction for Manufacturers
The EU Cyber Resilience Act explained simply: who it applies to, what manufacturers must do, the key dates up to December 2027, and where to start.
- CRA Annex I: The 22 Essential Requirements in Plain Language
All 22 essential cybersecurity requirements of the Cyber Resilience Act's Annex I, explained one by one: 14 for the product, 8 for vulnerability handling.
Reporting under Article 14
- CRA Article 14: The 24-Hour Early Warning, Field by Field
Since 11 September 2026, CRA Article 14 requires a 24-hour early warning. What ENISA's platform actually asks for, when the clock starts, and the three traps.
- ENISA SRP for the CRA: Registration, Roles and the Rules That Trip People Up
How ENISA's CRA reporting platform works: Primary and Secondary AR roles, verification, 7-day invitations, private drafts and the rules that trip people up.
- ENISA's CRA Reporting Platform: What the 72-Hour and Final Reports Require
Field by field: what ENISA's Single Reporting Platform requires in the CRA 72-hour notification and the final reports, with every character limit.
- When Does a Manufacturer 'Become Aware' Under the CRA?
Every CRA Article 14 deadline runs from the moment you become aware. The Commission's guidance defines it — and closes the loophole of delaying the assessment.
- CRA Severe Incident: The Two Tests of Article 14(5)
When is an incident 'severe' under the Cyber Resilience Act? Article 14(5) has two alternative tests — and most summaries leave out the second one.
- CRA Article 14(6): The Intermediate Report Nobody Plans For
Beyond the 24-hour, 72-hour and final reports, the CRA lets the coordinating CSIRT request an intermediate report — with a deadline it sets. What to prepare.
- Vulnerability in a Third-Party Component: Do You Have to Report It Under the CRA?
A library in your product is vulnerable. Must you notify under CRA Article 14? The Commission's guidance gives a clear test: was it exploited in your product?
Vulnerability handling and user information
- CRA Coordinated Vulnerability Disclosure: What Annex I Requires
The Cyber Resilience Act requires a coordinated vulnerability disclosure policy. What Annex I asks for, how to make it findable, and a free template.
- CRA SBOM Requirements: What Annex I Actually Asks For
Does the Cyber Resilience Act require an SBOM? Yes. What Annex I says about format and depth, whether it must be public, and who can ask to see it.
- CRA User Information: The Nine Items of Annex II
What the Cyber Resilience Act requires you to tell the users of your product: all nine items of Annex II, the support end date, and three traps.
- CRA Support Period: Why Five Years Is Not the Default
The CRA sets a minimum five-year support period. The Commission says plainly that five years is not the default. What Article 13(8) really requires.
Scope, classification and the technical file
- Does the CRA Apply to Products Already on the Market?
Products sold before December 2027 escape most CRA requirements — but not the reporting obligations. Article 69(3) explained, with the Commission's guidance.
- When Is the Cloud Part of Your Product Under the CRA?
Under the Cyber Resilience Act, a cloud backend can be part of your product. The Article 3 test, recital 12's smart home example, and what stays out of scope.
- CRA Important Products: Class I, Class II and the Core Functionality Test
Is your product in CRA Annex III? All 19 Class I and 4 Class II categories, the core functionality test, and what each class means for conformity.
- CRA Technical Documentation: The Annex VII Checklist
The eight items Annex VII of the Cyber Resilience Act requires in your technical file — plus when it must exist, how long to keep it, and in what language.
- CRA Fines: The Three Penalty Tiers of Article 64
Cyber Resilience Act fines reach €15 million or 2.5% of worldwide turnover. How the three tiers of Article 64 work, and which breach falls where.