Purpose
From 11.12.2027 a product with digital elements may only be made available on the Union market if it meets the essential cybersecurity requirements of Annex I (Regulation (EU) 2024/2847), has undergone a conformity assessment procedure pursuant to Annex VIII has technical documentation pursuant to Annex VII and bears the CE marking . This skill performs the gap analysis against Annex I, determines the permissible assessment route and plans the lead time — in particular where a notified body must be involved.
⚠️ Currency (as of 2026-07): The regulation entered into force on 10 December 2024 . Since 11.06.2026 the provisions on conformity assessment bodies and notified bodies have applied — the infrastructure for assessment is therefore only now being built up. From 11.09.2026 the reporting obligations under Article 14 CRA apply. The material product requirements dealt with here apply from 11.12.2027.
The order is deceptive. The fact that the product requirements apply last does not make them the last work package: for important products of Class II and for critical products pursuant to Annex IV, a notified body must be involved, whose capacity is limited and whose lead time is considerable. Anyone who starts looking for appointments in 2027 will miss the deadline.
Harmonised standards: The standardisation request for the CRA is ongoing.
[unverifiziert - prüfen]As of 07/2026, the citation status of harmonised standards in the Official Journal must be verified; without citation in the Official Journal there is no presumption of conformity. Existing certifications under ISO/IEC 27001 or IEC 62443 are reusable preliminary work, but not proof of conformity under the CRA.Sanctions framework: Violations of the essential cybersecurity requirements are punishable by up to EUR 15 million or 2.5% of worldwide annual turnover , whichever amount is higher (Article 64 CRA).
Inputs
- Product, version, architecture and context of use; delimitation of the product including remote processing solutions
- CRA classification from the product inventory: standard, important product Annex III Class I or II, critical product Annex IV
- Existing risk assessment, threat model and security architecture
- Inventory of third-party and open-source components including versions and licences
- Existing certifications and test reports (ISO/IEC 27001, IEC 62443, Common Criteria, penetration tests)
- Planned support period and update infrastructure (signature, distribution, rollback)
- Existing user documentation, security notices, configuration instructions
- Schedule until 11 December 2027 and available internal capacity
Sub-agent architecture
Three conceptual roles structure the analysis. A requirements analyst translates Annex I Part I and Part II into a product-specific requirements list and marks for each requirement whether it is fulfilled, partially fulfilled or open; in doing so, they necessarily rely on the cybersecurity risk assessment, because Annex I applies according to the risk and not schematically. A conformity architect derives the permissible assessment route under Annex VIII from the classification under Annex III/IV, checks the availability of harmonised standards and plans the involvement of a notified body backwards from 11 December 2027. A documentation reviewer compiles the technical documentation under Annex VII, the EU declaration of conformity and the user information and checks them for completeness. The requirements analyst provides the basis; the other two roles build on it.
Procedure
1. Cybersecurity risk assessment as the basis (Art. 13 CRA)
The CRA does not require schematic fulfilment of a catalogue, but fulfilment of the requirements on the basis of a cybersecurity risk assessment of the specific product. This assessment is the anchor of the entire compliance:
- It covers intended use and reasonably foreseeable misuse
- It identifies threats, attack surfaces, protection objectives and residual risks
- It justifies which requirements of Annex I Part I apply and to what depth and which are not applicable due to the product
- It is part of the technical documentation under Annex VII and must be kept up to date throughout the entire support period
Listing a requirement as "not applicable" is permissible — but only with a documented justification from the risk assessment.
2. Annex I Part I — Cybersecurity properties of the product (Annex I CRA)
Products must be designed, developed and produced in such a way that they ensure a level of cybersecurity appropriate to the risk and are made available without known exploitable vulnerabilities . The catalogue in Annex I Part I includes in particular:
- Delivery with a secure default configuration including the option to restore the delivery state
- Protection against unauthorised access through suitable authentication, identity and access management, including notification of failed access attempts
- Confidentiality of stored, transmitted and processed data, in particular through state-of-the-art encryption
- Integrity of data, commands, programs and configuration; notification of unauthorized modifications
- Data minimization — processing only the data required for the purpose
- Protection of the availability of essential functions, including after an incident, as well as resilience against overload attacks
- Minimization of the attack surface, including external interfaces
- Limitation of harmful effects through isolation and segmentation mechanisms
- Provision of logging and monitoring functions (logging of security-relevant events) that can be activated by the user
- Ability to securely and completely delete and transfer data and configuration
- Provision of security updates, where technically possible separately from function updates and with the option of automatic installation together with the possibility of deactivation
[unverifiziert - prüfen] The exact numbering and the final wording of the individual requirements must be verified against the Official Journal text of Annex I Part I.
3. Annex I Part II — Requirements for vulnerability handling (Annex I CRA)
Part II obliges the manufacturer, throughout the entire support period , to operate a functioning vulnerability management process:
- Identify and document vulnerabilities and components identify and document, including a software bill of materials (SBOM) at least for the top-level dependencies
- Remedy vulnerabilities without delay, in particular through security updates
- Regular tests and reviews of product security
- After providing an update: disclose information about remedied vulnerabilities publicly, with description, impact, severity and remediation guidance
- Coordinated vulnerability disclosure: implement and publish policy
- Measures to facilitate the reporting of vulnerabilities, including a contact address
- Mechanisms for the secure distribution of updates, including signature and integrity verification
- Provide security updates without delay and free of charge , together with guidance for users
The operational implementation is covered by the skill cra-schwachstellenmanagement.
4. Software bill of materials (SBOM) (Annex I Part II CRA)
The SBOM is the practical prerequisite for being able to assess within 24 hours in an incident whether a product is affected. It thus links the product requirements directly with the reporting obligation under Art. 14 CRA.
Requirements for maintenance:
- Machine-readable format (such as SPDX or CycloneDX), not tables in running text
- At least the top-level dependencies; deeper levels, insofar as risk-relevant
- For each component: name, version, source, license, unique identifier
- Automated generation in the build process instead of manual maintenance; each shipped version receives its SBOM
- Comparison against vulnerability databases as an ongoing process
- Retention as part of the technical documentation
The SBOM does not have to be published generally; however, it must be presented to the market surveillance authority upon request.
5. Support period and security updates (Art. 13 CRA)
The manufacturer determines the support period based on the expected useful life of the product. [unverifiziert - prüfen] The CRA provides as a general rule a period of at least five years , unless the expected useful life is shorter; the exact design must be verified against the Official Journal text of Art. 13 CRA.
Consequences:
- The support period must, before making the product available , be determined, justified and clearly and understandably communicated to users
- During the period, security updates must be promptly and free of charge provided
- Security updates must, insofar as technically possible, be offered separately from feature updates ; users must not be forced to accept feature changes in order to remain secure
- Information provided after expiry about remedied vulnerabilities must remain available
- The period must be contractually passed through the supply chain — otherwise supplier support ends before one's own obligation
6. Conformity assessment and harmonized standards (Annex VIII CRA)
The permissible route follows the classification from the product inventory:
| Classification | Permissible procedures under Annex VIII |
|---|---|
| Standard product | internal control (Module A) — manufacturer's own responsibility |
| Annex III Class I | internal control, if a harmonized standard is fully applied; otherwise involvement of a notified body |
| Annex III Class II | Involvement of a notified body (EU type examination Module B + C or comprehensive quality assurance Module H) |
| Annex IV (critical) | highest level; possibly European cybersecurity certification |
[unverifiziert - prüfen] The assignment of modules to the classes must be verified against the Official Journal text of Annex VIII.
Planning backwards from the 11.12.2027: Selection of the notified body, capacity request, preparation of the technical documentation, assessment, reworking, issuance. Where a notified body is required, the appointment must be secured now ; the designation of notified bodies has only been running since 11.06.2026.
7. Technical documentation, declaration of conformity and CE marking (Annex VII CRA)
Technical documentation (Annex VII) — to be created before placing on the market, updated during the support period and retained after placing on the market for at least ten years or for the duration of the support period, whichever period is longer. [unverifiziert - prüfen] Verify the retention period against the Official Journal text. Content in particular:
- General product description, intended use, versions
- Description of design, development and production including architecture
- Cybersecurity risk assessment pursuant to Art. 13 CRA
- Applied harmonised standards or other technical specifications
- Test reports for verification of the requirements of Annex I
- Information on the support period and on vulnerability handling
- SBOM and information on the components
EU declaration of conformity (Annex V) — the manufacturer declares fulfilment of the essential requirements and thereby assumes responsibility. It must be attached to or provided with the product.
CE marking — to be affixed visibly, legibly and permanently; for software, on the accompanying documentation or in the declaration of conformity. It may only be affixed after the conformity assessment has been completed.
User information (Annex II) — contact point for vulnerability reports, information on the support period, instructions on secure commissioning, configuration and decommissioning.
Sources
Statutes
- Regulation (EU) 2024/2847 (Cyber Resilience Act) — full text with annexes
- Art. 13 CRA (obligations of manufacturers, risk assessment, support period), Art. 14 CRA (reporting obligations), Art. 52 CRA (market surveillance), Art. 64 CRA (sanctions)
- Annex I Part I CRA (cybersecurity properties), Annex I Part II CRA (vulnerability handling), Annex II CRA (user information), Annex III CRA (important products), Annex IV CRA (critical products), Annex V CRA (EU declaration of conformity), Annex VII CRA (technical documentation), Annex VIII CRA (conformity assessment procedures)
- Regulation (EU) 2019/881 (Cybersecurity Act) — European cybersecurity certification
Guidelines
- European Commission, Cyber Resilience Act — policy page and FAQ on implementation
- BSI — technical guidelines and implementation notes
- CEN/CENELEC JTC 13 — standardisation request for the harmonised standards under the CRA
- ISO/IEC 29147 and ISO/IEC 30111 as a reference framework; IEC 62443 for industrial products
Case law: On the Cyber Resilience Act, no case law is apparent (as of 07/2026); the substantive requirements apply only from 11.12.2027. Decisions on CE product safety law can at most be drawn on by analogy and must be expressly identified as an analogy.
Output format
CRA-PRODUKTANFORDERUNGEN — GAP-ANALYSE — <Produkt/Version> — <Datum>
I. Einstufung [Standard / Anhang III Kl. I /
Anhang III Kl. II / Anhang IV]
II. Risikobewertung (Art. 13 CRA) [vorhanden / Lücke — <…>]
III. Anhang I Teil I — Eigenschaften
Sichere Standardkonfiguration [erfüllt / teilweise / offen]
Zugriffsschutz / Authentifizierung[…]
Vertraulichkeit / Integrität […]
Angriffsflächenminimierung […]
Protokollierung […]
Sichere Löschung / Übertragung […]
Update-Mechanismus […]
IV. Anhang I Teil II — Schwachstellen
SBOM [Format, Tiefe, Automatisierung]
Behebung / Tests / Offenlegung […]
CVD-Policy […]
Sichere Update-Verteilung […]
V. Unterstützungszeitraum [Dauer, Begründung, Kommunikation]
VI. Konformitätsbewertung (Anhang VIII)[interne Kontrolle /
notifizierte Stelle — Termin <…>]
Harmonisierte Normen [Zitierungsstand prüfen]
VII. Dokumentation
Technische Dokumentation (Anhang VII) […]
EU-Konformitätserklärung (Anhang V) […]
Nutzerinformationen (Anhang II) […]
CE-Kennzeichnung […]
VIII. Fristen 11.12.2027 vollständige Geltung
11.09.2026 Meldepflichten
IX. Sanktionsrisiko (Art. 64 CRA) [bis 15 Mio. EUR / 2,5 %]
Risikoeinstufung: 🟢 / 🟡 / 🔴
Empfehlung: <…>
Nächste Schritte: <…>
Risks / typical mistakes
- Annex I worked through schematically — the requirements apply in accordance with the cybersecurity risk assessment. Without it, neither compliance nor non-applicability can be substantiated.
- Notified body approached too late — for Annex III Class II and Annex IV, a notified body must be involved; the designation of these bodies has only been underway since 11.06.2026, and capacity is scarce.
- Harmonised standard assumed to exist — a presumption of conformity arises only from standards cited in the Official Journal . ISO/IEC 27001 and IEC 62443 do not establish it.
- SBOM maintained manually — a table without build integration is worthless in an incident and prevents the assessment of affectedness within 24 hours.
- Support period not determined or not communicated — it must be determined before placing on the market, substantiated and communicated to users.
- Supplier support shorter than one's own support period — the period must be passed down contractually through the supply chain.
- Security updates coupled with functional updates — they must, as far as technically possible, be offered separately and free of charge .
- Placing on the market with a known exploitable vulnerability — Annex I Part I requires delivery without known exploitable vulnerabilities; a known, unpatched risk in the state as delivered is a core infringement.
- CE marking affixed before completion of the assessment — impermissible and itself subject to sanctions.
- Technical documentation treated as a one-off — it must be kept updated over the support period.
- Remote processing solution excluded — functionally necessary cloud components form part of the product and are subject to the requirements.
- ⚠️ Annex and article numbers adopted without verification — several details here are
[unverifiziert - prüfen]and must be verified against the Official Journal text of Regulation (EU) 2024/2847 before use addressed to the client.