CRA Glossary - the Central Terms of the Cyber Resilience Act

The Cyber Resilience Act (Regulation (EU) 2024/2847) comes with its own vocabulary - from “product with digital elements” through “Module H” to the “single reporting platform”. This glossary explains the roughly two dozen most important terms concisely and in alphabetical order, each with a reference to the relevant article or annex. It provides general technical and organisational explanations, not legal advice; the definitions are explanatory, not binding.

Annex I (essential requirements)

Annex I is the substantive core of the CRA. Part I lists the essential cybersecurity requirements for the product itself (e.g. secure default configuration, attack-surface minimisation, protection of confidentiality and integrity). Part II sets out the requirements for vulnerability handling throughout the support period. Breaches of Annex I fall into the highest penalty tier (up to €15 million or 2.5 % of worldwide annual turnover, whichever is higher, Art. 64(2)).

Annex III (important products, Class I/II)

Annex III lists the “important” products with elevated risk. Class I includes, for example, password managers, browsers, VPNs, anti-malware, network management, SIEM, operating systems and routers/modems/switches. Class II is stricter and covers hypervisors and container runtimes, firewalls/IDS/IPS and tamper-resistant microprocessors. For classification details see CRA product classes.

Annex IV (critical products)

Annex IV names the “critical” products: hardware devices with security boxes such as hardware security modules (HSM), smart meter gateways and other devices for advanced security purposes, including secure cryptoprocessing, and smartcards or similar devices, including secure elements. By delegated act, the Commission may require a European cybersecurity certificate at assurance level at least ‘substantial’ for these categories (Art. 8(1), Art. 32(4)). The technical category descriptions are provided by Implementing Regulation (EU) 2025/2392.

Annex VII (technical documentation)

Annex VII defines the content of the technical documentation: product description; design, development and production processes; vulnerability handling including architecture, SBOM and CVD policy; the risk assessment mapped to Annex I; support-period information; applied standards; and a copy of the EU declaration of conformity. It must be retained for at least ten years or for the duration of the support period, whichever is longer.

Authorised representative

An authorised representative (Art. 18) is a person established in the EU whom a manufacturer appoints by written mandate. They keep the EU declaration of conformity and the technical documentation available for authorities and assist with certain obligations. However, they cannot take over the manufacturer's core duties: design to Annex I, the risk assessment, vulnerability handling, drawing up the technical documentation and conformity in series production remain with the manufacturer (Art. 18(2)).

CE marking

The manufacturer affixes the CE marking (Art. 30) to declare that the product meets the CRA's essential requirements. It may only be affixed after a successful conformity assessment, the drawing up of the technical documentation and the issuing of the EU declaration of conformity. The CE obligation takes effect with the CRA's general application on 11 December 2027.

Conformity assessment

Conformity assessment (Art. 32, Annex VIII) is the procedure that demonstrates a product meets the essential requirements. The permitted route depends on the product class: default products self-assess (Module A), Class I products only where harmonised standards, common specifications or a European scheme at least “substantial” are applied in full, otherwise with third-party assessment; Class II and critical products always require third-party assessment. The affectedness check gives a first orientation per product.

Coordinated Vulnerability Disclosure (CVD)

Coordinated Vulnerability Disclosure is an orderly process through which security researchers and third parties can report vulnerabilities to the manufacturer before they become public. The CRA makes a CVD policy mandatory for manufacturers (Annex I Part II), including a contact address for reports. Already-remediated vulnerabilities are publicly disclosed once an update is available; in justified cases publication may be deferred until users could apply the patch (Annex I Part II(4)).

CSIRT

A CSIRT (Computer Security Incident Response Team) is the governmental response body designated by each member state under NIS2. Under the CRA, the coordinating CSIRT acts as the recipient of manufacturer reports under Art. 14 - together with ENISA via the single reporting platform. Which CSIRT designated as coordinator is competent follows from Art. 14(7), as a rule the Member State of the main establishment in the Union.

Distributor

A distributor (Art. 20) makes a product available on the market without being the manufacturer or importer. They act with due care and verify in particular that the CE marking is present and that the manufacturer or importer has met their obligations. They must not make non-conforming products available, take corrective action where needed and inform the parties involved.

ENISA single reporting platform

The single reporting platform (Art. 16) is the platform set up and operated by ENISA through which manufacturers submit their reports under Art. 14. Reports are submitted via the endpoint of the competent CSIRT designated as coordinator and are simultaneously accessible to ENISA (Art. 14(7)). The reporting obligations it is set up for have applied since 11 September 2026.

EU declaration of conformity

The EU declaration of conformity (Art. 28, Annex V) is the document in which the manufacturer declares, under sole responsibility, that the product meets the essential requirements. It states, among other things, product identification, the manufacturer or authorised representative, the standards applied and - where relevant - the notified body with procedure and certificate. It must be retained together with the technical documentation.

Harmonised standards

Harmonised standards are European standards drawn up on a request from the Commission. Once their reference is published in the Official Journal, conformity with the requirements they cover is presumed to the extent they are applied (Art. 27(1)). If they (or common specifications or a European cybersecurity certification scheme at assurance level at least “substantial”) are fully applied to a Class I product, self-assessment under Module A suffices (Art. 32(2)). Where they are absent or applied only in part, third-party assessment under Module B+C or H is required for Class I.

Importer

An importer (Art. 19), in the German text “Einführer”, is established in the EU and places on the EU market products bearing the name or trademark of a manufacturer established outside the EU (Art. 3(16)). They may place only conforming products on the market and verify that the conformity assessment has been carried out, the technical documentation drawn up and the CE marking affixed. They do not perform the conformity assessment themselves but inform manufacturers of vulnerabilities and authorities of significant risks.

Manufacturer

The manufacturer (Art. 13) bears the bulk of the CRA obligations: meeting Annex I Part I, vulnerability handling under Part II, risk assessment, technical documentation (Annex VII), conformity assessment (Art. 32), EU declaration of conformity (Art. 28), CE marking (Art. 30) and reporting (Art. 14). The manufacturer sets the support period so that it reflects the expected time of use, at least five years (shorter only where the expected use is shorter).

Market surveillance

Market surveillance rests with the authorities designated by the member states, which check and enforce compliance with the CRA. They can request the technical documentation and SBOM on a reasoned request, require corrective action and remove non-conforming products from the market. Incorrect, incomplete or misleading information supplied in response to a request from market surveillance authorities or notified bodies can be penalised with up to €5 million or 1 % of worldwide annual turnover, whichever is higher (Art. 64(4)).

Modules A / B+C / H

The modules denote the various conformity assessment procedures. Module A is internal self-assessment without a notified body. Module B (EU type-examination by a notified body) is combined with Module C (conformity to type); Module H assesses the full quality-assurance system. Class II and critical products must always go through B+C or H (or a certification scheme).

NIS2 (delimitation)

NIS2 (Directive (EU) 2022/2555, transposed in Germany by the BSI Act of 2 December 2025) regulates the cybersecurity of entities and their services; products are regulated by the CRA. The two complement each other: standalone SaaS and pure cloud services are in principle outside the CRA. NIS2 covers cloud computing services, as a rule only where the provider is at least a medium-sized enterprise (recital 12 CRA). Remote data processing is only within CRA scope where it is an integral part of a product with digital elements.

Notified body

A notified body is a conformity assessment body designated under Art. 43 and notified to the Commission that carries out assessments under Module B (EU type-examination) or Module H. For Class II products (Annex III) and critical products (Annex IV), third-party assessment is required in every case: by a notified body (Modules B and C, or Module H) or via a European cybersecurity certification scheme at assurance level at least “substantial”. A notified body is needed for Class I only where neither harmonised standards nor common specifications nor a European cybersecurity certification scheme (at least “substantial”) are fully applied; default-category products self-assess. The provisions on notified bodies (Art. 35-51) have already applied since 11 June 2026.

Open-source steward

An open-source steward (Art. 24, definition Art. 3(14)) is a legal person that systematically supports the development of free and open-source products with digital elements with a view to commercial activity, without itself being a manufacturer. A light-touch regime applies: a documented cybersecurity policy, cooperation with authorities and a limited slice of the reporting obligations. Steward duties do not trigger CE marking. Stewards are exempt from the fines in Article 64(3) to (9) (paragraph 10(b)); whether this also covers reporting infringements under paragraph 2 is not clear from the wording, though recital 120 points that way.

Product with digital elements (PDE)

A product with digital elements (Art. 3(1)) is a software or hardware product including its remote data processing solutions, as well as components placed on the market separately. The condition for application is that the intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (Art. 2(1)). The PDE is the central point of reference for the entire CRA.

Remote data processing

Remote data processing (Art. 3(2)) means data processing at a distance, for example in the cloud or a back end, whose software the manufacturer has designed and developed, or had designed and developed under its responsibility, and without which the product could not perform one of its functions. Such integral remote processing solutions are within CRA scope as part of the product with digital elements. Standalone SaaS offerings, by contrast, are in principle not covered (see NIS2).

Reporting duty (Art. 14)

Under Art. 14, the manufacturer must report actively exploited vulnerabilities and severe security incidents to the coordinating CSIRT and ENISA. Reportable are actively exploited vulnerabilities and severe incidents having an impact on the security of the product. The deadlines are staggered: early warning without undue delay and at the latest within 24 hours, notification within 72 hours, final report no later than 14 days after a corrective or mitigating measure is available (vulnerability) or one month after the notification (incident). The reporting obligations have applied since 11 September 2026.

SBOM (Software Bill of Materials)

An SBOM is a machine-readable inventory of a product's software components. Annex I Part II requires an SBOM in a commonly used, machine-readable format covering at least top-level dependencies. The Regulation does not prescribe a specific format. Examples of machine-readable formats are CycloneDX and SPDX (ISO/IEC 5962); what counts for the requirement is the content, at least the top-level dependencies. The SBOM is evidence for authorities on a reasoned request, not an obligation to publish it publicly.

Support period

The support period is the span during which the manufacturer must handle vulnerabilities and provide security updates. The manufacturer sets it so that it reflects the expected time of use; it is at least five years, shorter only where the expected use is shorter (Art. 13(8)). Technical documentation and the EU declaration of conformity must be retained for at least ten years or for the duration of the support period, whichever is longer.

Technical documentation

The technical documentation is the written evidence of conformity and follows Annex VII in content (see the separate entry above). It forms the basis for the conformity assessment, EU declaration of conformity and CE marking. Market surveillance authorities can request it on a reasoned request.

Vulnerability handling (Annex I Part II)

Vulnerability handling covers the obligations throughout the support period: identifying and documenting vulnerabilities and components (including an SBOM), remediating them without delay via security updates, testing regularly, disclosing fixed vulnerabilities (publication may be deferred in justified cases until users could apply the patch) and implementing a CVD policy. Security updates must be disseminated without delay and free of charge (a different arrangement is possible for tailor-made products for business users) and, where technically feasible, separated from feature updates.