CRA Annex I Essential Cybersecurity Requirements

Article 6 ties market access to Annex I. A product with digital elements may be made available on the market only if the product meets the applicable Part I requirements and the manufacturer's processes comply with Part II.

That means Annex I should be treated as a conformity argument, not as a generic security wishlist. The useful working file is a requirement register that shows the requirement, the product boundary, the risk assessment outcome, the implemented control, the test or review evidence, and the documentation location.

Annex I applies to all in-scope product categories, not only important or critical products. Classification changes the conformity route; it does not remove the essential cybersecurity requirements.

Most Annex I obligations apply from 11 December 2027. For products placed on the market before that date, Article 69 generally makes the remaining CRA requirements applicable only if the product undergoes a substantial modification from 11 December 2027. Article 14 reporting starts earlier, on 11 September 2026, and applies to all in-scope products placed on the market before 11 December 2027.

Part I starts with an overall requirement for an appropriate level of cybersecurity based on the risks, then lists product properties that apply where relevant. The Commission FAQ explains that manufacturers must determine relevance through the cybersecurity risk assessment, and that non-applicability needs a clear justification.

A practical Annex I Part I assessment should therefore avoid yes-or-no labels without evidence. Each answer should point to design choices and tests that show how the product meets the relevant outcome.

Part II is not limited to launch readiness. It sets the manufacturer's vulnerability-handling process for the product, including integrated components, throughout the support period.

The CRA does not require the same patch response for every vulnerability, but it does require the manufacturer to assess relevance and risk, then put appropriate remedies in place without delay. A remedy may be a patch, mitigation, configuration guidance, advisory, documentation change, or another suitable measure, depending on the risk.

The CRA covers planning, design, development, production, delivery, and maintenance. For Annex I, secure-by-design work is strongest when it produces records that are usable at release review and later by a notified body or market surveillance authority.

The goal is not to publish every internal engineering record. It is to maintain enough traceability to show how the product and the manufacturer's processes meet the applicable Annex I requirements.

A standard or guidance document can help design and test a control, but it creates a CRA presumption of conformity only when the legal conditions for that effect are met and only for the requirements it covers. Keep the product-specific risk assessment and any uncovered Annex I requirement in the file.

Use a crosswalk with four columns: CRA outcome, product-specific control, implementation source, and evidence. Record whether the source is a harmonised standard cited in the Official Journal, a common specification, a certification scheme with recognised effect, or supporting technical guidance.

Article 31 requires technical documentation to contain the data or details used to show that the product and the manufacturer's processes comply with Annex I. Annex VII then specifies the minimum documentation elements, including the cybersecurity risk assessment, vulnerability-handling process information, test reports, standards or alternative solutions, support-period information, and where applicable the SBOM.

The Commission FAQ emphasises that technical documentation may be requested by market surveillance authorities and should be comprehensive and clear. It also explains that the risk assessment and documentation should be updated where relevant information emerges after placement on the market.