Blackfort Technology
CRA reporting obligations have applied since 11 September 2026

CRA Readiness

Cyber Resilience Act: implementing CRA compliance systematically

Blackfort Technology guides manufacturers of software and connected products through the Cyber Resilience Act, Regulation (EU) 2024/2847: from the gap analysis through risk assessment, SBOM and reporting process to evidence an auditor can follow. The reporting obligations have applied since 11 September 2026, the remaining manufacturer obligations apply from 11 December 2027.

Request an initial callStart the scope check

Three ways into CRA implementation

Depending on where you stand: get oriented, measure where your products are, then implement.

  1. 1 · Get oriented

    Scope check

    Free and without registration: a first, schematic orientation in a few minutes on which CRA obligations may apply to products like yours. Plus the CRA checklist, the SBOM check and the CVD policy generator.

    Start the check

  2. 2 · Measure

    CRA gap analysis

    Product register, roles, product classes and a gap report per product against Annex I, with a prioritised action plan. The recommended first engagement.

    Gap analysis

  3. 3 · Implement

    CRA consulting & implementation

    Risk assessment per product, SBOM chain, Article 14 reporting process, technical documentation and preparation of the conformity assessment.

    All services

For management

Your CRA programme is already running? Have it reviewed independently.

The CRA readiness audit reviews the status independently of the project lead, with samples from the evidence, and reports to management.

CRA readiness audit
Christian Gebhardt, founder and managing director of Blackfort Technology

Your contact

Christian Gebhardt · Founder and managing director, Blackfort Technology

Christian Gebhardt, founder and managing director of Blackfort Technology, is happy to take your enquiry personally. In a free initial call you work out together what you need; the consulting is carried out by the Blackfort Technology team.

Profile on LinkedIn

Last updated: 2026-10-09

What Blackfort Technology Does for You

You commission the modules you need. The recommended first engagement is the gap analysis at a fixed price for the scope we agree in the free initial call; you then decide, with facts on the table, how far the programme should go.

All CRA consulting services →

Timeline of the Cyber Resilience Act deadlines with four milestones. 10 Dec 2024: entry into force on the 20th day after publication in the Official Journal (Art. 71(1)). 11 Jun 2026: Chapter IV applies, notification of conformity assessment bodies, Articles 35 to 51 (Art. 71(2)). 11 Sep 2026: reporting obligations for actively exploited vulnerabilities and severe incidents, also for products already on the market (Art. 14, Art. 69(3), Art. 71(2)). 11 Dec 2027: all other obligations, including Annex I, conformity assessment and CE marking (Art. 71(2)). A marker "As of October 2026" sits between 11 Sep 2026 and 11 Dec 2027. Note: products placed on the market before 11 Dec 2027 are subject to the other requirements only if substantially modified (Art. 69(2)); the Article 14 reporting obligations apply to them nonetheless (Art. 69(3)). Graphic as of October 2026.
CRA deadlines: entry into force, Chapter IV, reporting obligations and full application. Source: Articles 71 and 69 of Regulation (EU) 2024/2847.

Since 11 September 2026: The Cyber Resilience Act Reporting Obligations Apply

Since 11 September 2026, manufacturers of products with digital elements have been subject to binding reporting obligations under Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA). Actively exploited vulnerabilities and severe incidents must be reported via the single reporting platform simultaneously to the CSIRT designated as coordinator and to ENISA: early warning without undue delay and in any event within 24 hours, notification within 72 hours, final report 14 days after a corrective measure is available (vulnerabilities) or one month after the notification (incidents).

The remaining manufacturer obligations apply from 11 December 2027. Harmonised standards will make demonstrating conformity easier later; the reporting process, product register and SBOM can be built today without them.

Am I in scope? Find out now.

The CRA applies to manufacturers, importers and distributors of products with digital elements made available on the EU market in the course of a commercial activity, whether for payment or free of charge (Article 3(22)). Check the scope early, including for software, accessories and components.

Use the interactive scope check to get an initial assessment in minutes: What role do you play (manufacturer, importer, distributor)? Does your product fall under the CRA? And if so, what product class is it likely to fall into?

Start the scope check →

SMEs: No Size Exemption, but Clear Priorities

The Cyber Resilience Act does not provide a general exemption for SMEs. Smaller manufacturers of products with digital elements are in scope. There are, however, targeted relief provisions for micro and small enterprises, for example a simplified format for the technical documentation (Article 33(5)). Whether Article 64(10) exempts them from fines for a missed 24-hour early warning is, on its wording, a question of interpretation, because the provision only derogates from paragraphs 3 to 9; recital 120 points that way.

What matters most for SMEs: what to tackle first. Reporting processes (mandatory since September 2026) take priority over SBOM completeness and CE marking (deadline: December 2027). Knowing the priorities avoids unnecessary effort.

See the CRA roadmap for SMEs →

Knowledge: Background and Technical Detail

Frequently asked questions

When does the Cyber Resilience Act apply?+
The CRA has been in force since 10 December 2024. The first binding obligations, the reporting and notification requirements for vulnerabilities and security incidents, have applied since 11 September 2026. Full applicability of all product requirements begins on 11 December 2027.
As a software manufacturer, does the CRA apply to me?+
Software is a product with digital elements. It falls under the CRA if it is made available on the EU market in the course of a commercial activity, whether for payment or free of charge, and if its intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (Article 2(1), Article 3(22)). Whether your specific product is in scope and in which product class depends on its technical characteristics and function. The interactive scope check provides an initial orientation.
What do I need to have in place as a manufacturer for the reporting obligation?+
Since 11 September 2026, manufacturers have been required to report actively exploited vulnerabilities and severe incidents via the single reporting platform simultaneously to the CSIRT designated as coordinator and to ENISA: early warning without undue delay and in any event within 24 hours, notification within 72 hours, final report 14 days after a corrective measure is available or one month after the notification. This requires operational reporting processes, clear internal responsibilities, and ideally a functioning PSIRT or equivalent structure.
Does the CRA also apply to SMEs and small software companies?+
Yes. The Cyber Resilience Act does not provide a general exemption for SMEs or small software companies. Micro and small enterprises benefit from targeted relief, for example a simplified format for the technical documentation (Article 33(5)). Whether Article 64(10) exempts them from fines for a missed 24-hour early warning is, on its wording, a question of interpretation, because the provision only derogates from paragraphs 3 to 9; recital 120 points that way. The reporting obligation itself applies regardless of company size. There is no full scope exemption. Manufacturers of any size placing products with digital elements on the EU market are in scope in principle.
What is an SBOM and why is it relevant for the CRA?+
An SBOM (Software Bill of Materials) is a machine-readable inventory of the components in a software product. The CRA requires an SBOM in a commonly used machine-readable format covering at least the top-level dependencies (Annex I Part II(1)); it is part of the technical documentation (Annex VII(2)(b)) and the basis for vulnerability handling. Common formats are CycloneDX and SPDX; BSI TR-03183-2 requires CycloneDX 1.6 or later or SPDX 3.0.1 or later. The technical documentation must be retained for at least ten years or for the support period, whichever is longer (Article 13(13)).

Sources

This content provides general technical and organizational information on the Cyber Resilience Act (Regulation (EU) 2024/2847) and does not constitute legal advice (no legal services within the meaning of the German RDG).

Get in touch

Start with the CRA gap analysis

An assessment of your products against Annex I and the Article 14 reporting obligation: concrete, evidence-based and with a prioritised action plan. The initial call is free.

About the CRA gap analysisRequest an initial call