Cyber Resilience Act checklist: what manufacturers have to do

The three key dates for manufacturers

1. 10 Dec 2024

   Regulation enters into force

2. 11 Sep 2026

   Article 14 reporting obligations apply, including to products placed on the market before 11 Dec 2027

3. 11 Dec 2027

   The remaining manufacturer obligations apply, including Annex I, technical documentation and CE marking

The checklist

The order follows the dependencies: no product class without a product list, no reliable Annex I implementation without a risk assessment. Step 7 already applies and therefore comes first. The checklist summarises the main manufacturer obligations and is not exhaustive; the text of Regulation (EU) 2024/2847 is authoritative.

1. Step 1Art. 2, Art. 3, Art. 69

   Record your products and assess the scope

   The CRA applies to products with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. This covers hardware and software including their remote data processing solutions, and components placed on the market separately. Some products are excluded because other legislation applies, such as medical devices and in vitro diagnostic medical devices, type-approved motor vehicles and aviation products certified under Regulation (EU) 2018/1139.

   • List all products with variants and versions made available on the EU market
   • Record the data and network connections of each product
   • Capture the related remote data processing: remote processing whose software you design and develop yourself or under your responsibility and without which the product could not perform one of its functions (Art. 3(2))
   • Flag possible exclusions and borderline cases for legal review
   • Keep products already on the market separate: the reporting obligation applies to them too (Art. 69(3))

   Result: A product register with a technical assessment per product and the facts it is based on.

   • Scope check
   • Does the CRA apply to my product?
2. Step 2Art. 13, 19, 20, 21, 22

   Establish the role per product

   Obligations depend on the role. Manufacturers carry most of them, importers and distributors have their own verification duties. Anyone who places a product on the market under their own name or substantially modifies it may become a manufacturer.

   • Record the role per product: manufacturer, importer or distributor
   • Look separately at own-brand products and your own modifications to third-party products
   • Have software that you supply to other companies for integration assessed
   • Record suppliers and integrated third-party components

   Result: Role per product as a working basis, open cases flagged for review by your legal department.

   • Roles overview
   • Manufacturer obligations
3. Step 3Art. 7, 8, 32, Annex III and IV

   Determine product class and conformity assessment route

   Without an entry in Annex III or IV, internal control (module A) is sufficient. For important products in class I this applies only if harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least ‘substantial’ are applied in full; otherwise a notified body is needed (modules B and C or module H). Class II always requires one of these procedures or a certification scheme at assurance level at least ‘substantial’. For critical products under Annex IV, European certification applies where required under Article 8(1), otherwise the same procedures as for class II.

   • Check for each product whether it matches a category in Annex III or IV
   • Record the resulting assessment route
   • Where a notified body is needed, plan for its lead time
   • For borderline cases, document the technical characteristics the classification is based on

   Result: Product class and intended conformity assessment route per product.

   • Product classes explained
   • Conformity assessment and CE
4. Step 4Art. 13(2) to (4)

   Cybersecurity risk assessment per product

   The risk assessment is the basis for everything else: it determines which Annex I requirements are implemented and how. It is documented, included in the technical documentation and kept up to date during the support period.

   • Describe architecture, data flows and trust boundaries per product
   • Identify and rate threats systematically
   • Record for each Annex I Part I requirement whether and how it is implemented
   • Define a trigger for updates, such as every security-relevant release

   Result: A documented risk assessment per product, ready for the technical documentation.

   • Risk assessment and threat modelling
   • Service: risk assessment
5. Step 5Annex I Part I

   Implement the security requirements of Annex I Part I

   Based on the risk assessment, products must, where applicable, among other things be made available without known exploitable vulnerabilities and with a secure default configuration, allow security updates, protect against unauthorised access, protect the confidentiality and integrity of data, limit the attack surface, log security-relevant events and allow all data to be deleted securely.

   • Check for known exploitable vulnerabilities before each version is made available on the market
   • Secure default configuration and reset to the original state
   • Authentication and access control with reporting of possible unauthorised access, encryption where appropriate
   • Updatability, where applicable automatic security updates with opt-out
   • Logging of security-relevant events with an opt-out for users, and secure deletion of all data and settings
   • Provide for data minimisation, availability of essential functions including against denial-of-service attacks, minimal impact on other devices and networks, and exploitation mitigation
   • Embed security testing in development and retain the results

   Result: Implementation status per requirement with evidence, open points in the action plan.

   • Implementing security by design
6. Step 6Annex I Part II, Art. 13(5) and (6)

   SBOM and vulnerability handling under Annex I Part II

   Manufacturers must identify and document components and vulnerabilities, including by drawing up a software bill of materials in a commonly used machine-readable format covering at least the top-level dependencies. Vulnerabilities must be remediated without delay, and fixed vulnerabilities disclosed once the update is available. Due diligence applies to third-party components.

   • Generate an SBOM per release automatically from the build, for example in CycloneDX or SPDX
   • Continuously match components against vulnerability databases and assess the hits
   • Distribute security updates without delay and, where technically feasible, separately from feature updates, free of charge (a different arrangement on charges is possible only for tailor-made products agreed with a business user)
   • Publish a coordinated vulnerability disclosure (CVD) policy and a contact address
   • Report vulnerabilities found in third-party components to their manufacturer or maintainer

   Result: An SBOM per release, a working vulnerability process and a published CVD policy.

   • Check your SBOM for free
   • CVD policy generator
   • SBOM requirements under the CRA
7. Step 7Art. 14, Art. 16, Art. 69(3)Already applies

   Operate the Article 14 reporting process

   Actively exploited vulnerabilities and severe incidents having an impact on the security of the product must be notified through the single reporting platform simultaneously to the CSIRT designated as coordinator and to ENISA: an early warning notification without undue delay and in any event within 24 hours of becoming aware, a notification without undue delay and in any event within 72 hours. The final report follows, for a vulnerability, no later than 14 days after a corrective or mitigating measure is available, and for an incident within one month of the notification.

   • Define an intake for reports of vulnerabilities and incidents, including outside business hours
   • Record criteria: when is a vulnerability actively exploited (Art. 3(42)), when is an incident severe (Art. 14(5))
   • Name roles with deputies for assessing, deciding and reporting
   • Prepare templates for early warning, notification and final report
   • Plan how affected users are informed (Art. 14(8))
   • Walk through the process once using an example

   Result: A reporting process that can meet the deadlines, with named roles and templates.

   • Reporting obligation in detail
   • Service: reporting process
8. Step 8Art. 13(8), (9) and (19), Annex II(7)

   Define the support period

   The support period during which vulnerabilities are handled reflects the time the product is expected to be in use and is at least five years. Where the product is expected to be in use for less than five years, it corresponds to the expected use time. Security updates made available remain available for at least ten years or for the remainder of the support period, whichever is longer.

   • Define the support period per product and record the reasons in the technical documentation
   • State the end date, at least month and year, in an easily accessible way at the time of purchase and in the user information
   • Check whether supply chains and capacity cover the period

   Result: A defined support period with end date per product.

   • Support period and update duty
9. Step 9Art. 13(13) and (15) to (17), Art. 28, 30, 31, 32, Annex II and VII

   Technical documentation, user information and CE marking

   Before placing a product on the market from 11 December 2027, the technical documentation under Annex VII, the information and instructions to the user under Annex II, the conformity assessment, the EU declaration of conformity and CE marking must be in place. Documentation and declaration are kept for at least ten years or for the support period, whichever is longer.

   • Build the technical documentation under Annex VII, including the risk assessment
   • Prepare the information and instructions to the user under Annex II
   • Carry out the conformity assessment via the chosen route
   • Issue the EU declaration of conformity and affix the CE marking
   • Provide product identification, manufacturer contact details and a single point of contact for vulnerability reports (Art. 13(15) to (17))
   • Keep the technical documentation up to date at least during the support period and retain it; after a substantial modification, check whether a new conformity assessment is needed

   Result: Documentation per product, ready for the conformity assessment and market surveillance.

   • Technical documentation under Annex VII
   • Service: documentation

Frequently asked questions

This content provides general technical and organizational information on the Cyber Resilience Act (Regulation (EU) 2024/2847) and does not constitute legal advice (no legal services within the meaning of the German RDG).

Last updated: 2026-10-08