Decide whether software, hardware, a separately marketed component, or necessary remote processing is a under the CRA (Regulation (EU) 2024/2847), which regulated role you hold, and what must happen before EU market placement and during the .
Use the timeline and topic guides to move from product classification to release gates, security-update operations, reporting readiness, and market-surveillance evidence.
Start with the product boundary and exclusions, then classify the product, assign the economic-operator roles, map Annex I and lifecycle duties, choose the conformity route, and prepare for reporting from 11 September 2026 and general application from 11 December 2027.
Focused CRA guidance
Use these focused answers for classification, conformity assessment, open-source scope, and reporting under the EU Cyber Resilience Act (CRA). The complete guide library remains available below.
Start with the product category and conformity route. A is an independent organization designated by an EU country to assess specified products and procedures. Most ordinary products can use the manufacturer's internal-control route, so a notified body is not always required.
Read the notified-body answerConnect the product category to the permitted route. is the manufacturer's internal control. combines an EU-type examination with production checks. is full quality assurance under notified-body oversight. Record the selected route, EU declaration of conformity, and basis.
Review conformity assessmentis the full-quality-assurance route. A approves and monitors the manufacturer's quality system, while the manufacturer remains responsible for each product's conformity and the supporting technical documentation.
Read the Module H answerFree and open-source software lets people inspect, use, change, and redistribute its source code. Separate non-commercial publication from commercial market activity, then identify whether the organization acts as a contributor, open-source software steward, or product manufacturer.
Review open-source scoperequires manufacturers to report an and a severe incident when the relevant test is met. Those reporting duties start on 11 September 2026; most other CRA duties apply from 11 December 2027. Keep the two dates and reporting tests separate.
Review Article 14 reportingTrack the staged application of Chapter IV notified-body rules from 11 June 2026, reporting from 11 September 2026, the main CRA obligations from 11 December 2027, and the related transition rules for products already placed on the market.
New to the CRA? Start with scope. If the product is already scoped, jump to requirements, evidence and market access, vulnerability operations and deadlines, or a focused comparison or question.
Decide whether the CRA applies to the product, market activity and software or service boundary before assigning controls.
Translate Annex I and economic-operator duties into a product-level compliance program.
Build the release file, select the conformity route, and connect technical evidence to the declaration and CE marking.
Run support-period vulnerability handling, triage Article 14 events, track staged application dates, and understand enforcement exposure.
Separate the CRA from adjacent EU and UK product-security regimes, or go directly to a focused implementation answer.
This hub is the shared entry point for CRA product classification, vulnerability-handling design, reporting readiness, technical documentation, conformity assessment, , and importer or distributor checks.
