EU CRA timeline and checklist for device makers

In short

• The EU Cyber Resilience Act (CRA) covers connected products sold in the EU, wherever they are made. It does not cover products sold only in India, the UK or the US.
• Reporting of actively exploited vulnerabilities has applied since 11 September 2026. The full rules apply from 11 December 2027.
• Use the checklist at the end of this page, or download it as a PDF checklist.

The Cyber Resilience Act is Regulation (EU) 2024/2847. It sets security rules for "products with digital elements": hardware and software that connect to a device or a network. A router, a security camera, a smart plug and the app that controls them are all in scope.

This page is the short map. For an Indian exporter's view of the same rules, read our post on what the CRA asks of exporters.

Who does the EU CRA apply to?

It applies to products made available on the EU market, through your own brand or through an importer. The obligations fall mainly on the manufacturer: whoever develops or makes the product and sells it under its own name.

An importer may only place your product on the EU market after checking that you did the conformity assessment, drew up the technical documentation and supplied the CE marking, the declaration of conformity and the user information. So the questions reach you through your importer's questionnaire long before any regulator writes.

If a product is not sold in the EU, the CRA does not apply to it. A camera sold only in India follows Indian rules, and one sold only in the UK follows the UK's.

What are the EU CRA dates?

A product placed on the market before 11 December 2027 falls under the full rules only if it is substantially modified later. The reporting duty covers it from September 2026 either way.

How does Article 14 reporting work?

When you become aware that attackers are exploiting a vulnerability in your product, three reports follow. A severe incident affecting the security of your product has its own three.

Reports go through the Single Reporting Platform of ENISA, the EU's cyber security agency, to the national computer security team (CSIRT) acting as coordinator. A manufacturer with no base in the EU reports to the CSIRT of the member state where its authorised representative acts. The European Commission's reporting page explains the route.

The clock starts when you become aware, not when you have finished investigating. Name the person who owns the reporting inbox, and give them the authority to send a report on a weekend.

What goes in the technical file?

The technical documentation of Annex VII is the core of your evidence. Plan for it to hold at least:

• the cybersecurity risk assessment of Article 13, kept up to date during the support period
• a software bill of materials (SBOM) "in a commonly used and machine-readable format", covering at least the top-level dependencies (Annex I, Part II)
• the support period and how you chose it: at least five years, unless the product is expected to be in use for less
• your coordinated vulnerability disclosure policy and a single point of contact for vulnerability reports
• test reports, the EU declaration of conformity and the user information of Annex II

Keep the technical documentation and the declaration for at least ten years after the product is placed on the market, or for the support period if that is longer.

Which products need more than self-assessment?

Annex III lists important products. Routers, modems and switches are class I, and so are smart home products with security functions, such as security cameras. For these, you can assess conformity yourself only by applying harmonised standards, common specifications or a European certification scheme in full. Otherwise a notified body takes part.

The harmonised standards for the CRA are still being written; the Commission's standardisation page tracks them. Until one for your product type is cited in the Official Journal, plan for notified body time.

Radio equipment already has its own security rules until the CRA applies in full: see our guide to ETSI EN 303 645 and EN 18031.

The EU CRA checklist

Work through these in order. The same list is in the PDF checklist.

• Confirm which of your products are sold in the EU and are products with digital elements.
• Check whether each product is listed in Annex III or Annex IV, to choose the conformity assessment route.
• Name the person who reports actively exploited vulnerabilities and severe incidents, with the authority to report within 24 hours.
• Know which CSIRT you report to and how you reach ENISA's Single Reporting Platform.
• Publish a coordinated vulnerability disclosure policy and a single point of contact for vulnerability reports.
• Produce an SBOM for every release, in a commonly used machine-readable format, covering at least the top-level dependencies.
• Set the support period for each product, at least five years unless the product is expected to be in use for less, and show its end date at the time of purchase.
• Run and document the cybersecurity risk assessment, and update it during the support period.
• Map your evidence to Annex I, Part I (security requirements) and Part II (vulnerability handling).
• Prepare the technical documentation of Annex VII and the user information of Annex II.
• Keep the technical documentation and the EU declaration of conformity for at least ten years, or for the support period if longer.
• Keep each security update available for at least ten years after it is issued, or for the rest of the support period if longer.
• Draw up the EU declaration of conformity and affix the CE marking before placing products on the market from 11 December 2027.

Where does this fit with other markets?

The CRA is one market's rules. Our map of device security frameworks by market sets it beside India, the UK and the US, so one set of firmware evidence can serve all four.

Keeping the evidence release by release

FDIE by Magdox gathers much of this evidence from each analysed firmware release: the SBOM, the device checks behind Annex I, and drafts of the technical file, the declaration of conformity and the user information that people review and sign. Article 14 cases run the 24 hour, 72 hour and 14 day clocks, and a person submits on ENISA's platform. It is evidence and gap finding, not certification; a notified body or a market regulator makes the final call.