CRA Annex I Essential Cybersecurity Requirements

Article 6 ties market access to Annex I. A product with digital elements may be made available on the market only if the product meets the applicable Part I requirements and the manufacturer's processes comply with Part II.

That means Annex I should be treated as a conformity argument, not as a generic security wishlist. The useful working file is a requirement register that shows the requirement, the product boundary, the risk assessment outcome, the implemented control, the test or review evidence, and the documentation location.

Part I starts with an overall requirement for an appropriate level of cybersecurity based on the risks, then lists product properties that apply where relevant. The Commission FAQ explains that manufacturers must determine relevance through the cybersecurity risk assessment, and that non-applicability needs a clear justification.

A practical Annex I Part I assessment should therefore avoid yes-or-no labels without evidence. Each answer should point to design choices and tests that show how the product meets the relevant outcome.

Part II is not limited to launch readiness. It sets the manufacturer's vulnerability-handling process for the product, including integrated components, throughout the support period.

The CRA does not require the same patch response for every vulnerability, but it does require the manufacturer to assess relevance and risk, then put appropriate remedies in place without delay. A remedy may be a patch, mitigation, configuration guidance, advisory, documentation change, or another suitable measure, depending on the risk.

The CRA covers planning, design, development, production, delivery, and maintenance. For Annex I, secure-by-design work is strongest when it produces records that are usable at release review and later by a notified body or market surveillance authority.

The goal is not to publish every internal engineering record. It is to maintain enough traceability to show how the product and the manufacturer's processes meet the applicable Annex I requirements.

Article 31 requires technical documentation to contain the data or details used to show that the product and the manufacturer's processes comply with Annex I. Annex VII then specifies the minimum documentation elements, including the cybersecurity risk assessment, vulnerability-handling process information, test reports, standards or alternative solutions, support-period information, and where applicable the SBOM.

The Commission FAQ emphasises that technical documentation may be requested by market surveillance authorities and should be comprehensive and clear. It also explains that the risk assessment and documentation should be updated where relevant information emerges after placement on the market.