CRA guides

Practical explanations of the Cyber Resilience Act reporting obligations and technical file. Every statement is checked against the Regulation, ENISA's platform documentation or the Commission's guidance. Free to read.

• CRA Article 14: The 24-Hour Early Warning, Field by Field

  Since 11 September 2026, CRA Article 14 requires a 24-hour early warning. What ENISA's platform actually asks for, when the clock starts, and the three traps.

• ENISA's CRA Reporting Platform: What the 72-Hour and Final Reports Require

  Field by field: what ENISA's Single Reporting Platform requires in the CRA 72-hour notification and the final reports, with every character limit.

• CRA Severe Incident: The Two Tests of Article 14(5)

  When is an incident 'severe' under the Cyber Resilience Act? Article 14(5) has two alternative tests — and most summaries leave out the second one.

• Does the CRA Apply to Products Already on the Market?

  Products sold before December 2027 escape most CRA requirements — but not the reporting obligations. Article 69(3) explained, with the Commission's guidance.

• Vulnerability in a Third-Party Component: Do You Have to Report It Under the CRA?

  A library in your product is vulnerable. Must you notify under CRA Article 14? The Commission's guidance gives a clear test: was it exploited in your product?

• CRA Technical Documentation: The Annex VII Checklist

  The eight items Annex VII of the Cyber Resilience Act requires in your technical file — plus when it must exist, how long to keep it, and in what language.

• CRA Support Period: Why Five Years Is Not the Default

  The CRA sets a minimum five-year support period. The Commission says plainly that five years is not the default. What Article 13(8) really requires.

• When Does a Manufacturer 'Become Aware' Under the CRA?

  Every CRA Article 14 deadline runs from the moment you become aware. The Commission's guidance defines it — and closes the loophole of delaying the assessment.

• CRA Article 14(6): The Intermediate Report Nobody Plans For

  Beyond the 24-hour, 72-hour and final reports, the CRA lets the coordinating CSIRT request an intermediate report — with a deadline it sets. What to prepare.

• CRA Important Products: Class I, Class II and the Core Functionality Test

  Is your product in CRA Annex III? All 19 Class I and 4 Class II categories, the core functionality test, and what each class means for conformity.