Grounded implementation guidance for legal, product, and engineering teams.
Use official CRA sources to translate obligations into owners, evidence, and shipping decisions.
Structured answer sets in this page tree.
Cited legal and guidance references.
The CRA requirement set is broader than Annex I alone. Article 13 creates the main manufacturer obligations. Articles 18 to 23 distribute duties across importers, distributors, and authorised representatives. Article 24 adds obligations for open source software stewards. Article 14 adds reporting. Article 31 and Article 28 bring the file and declaration duties together.
Manufacturers carry the heaviest load. They must assess cybersecurity risks, determine which Annex I Part I requirements are relevant, justify non applicability, exercise due diligence when integrating components, determine and disclose a support period, draw up technical documentation, complete conformity assessment, and issue the declaration before affixing the CE marking.
They also need a single point of contact for vulnerability communication, user instructions under Annex II, corrective action procedures, and cooperation with authorities.
Assessment Autopilot can take EU Cyber Resilience Act, CRA Product Security and CE Marking Requirements from turning the requirements into assigned actions to a reusable workflow inside Sorena. Teams working on EU Cyber Resilience Act, CRA Product Security and CE Marking can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from EU Cyber Resilience Act, CRA Product Security and CE Marking Requirements and turn the guidance into owned tasks, evidence requests, and review checkpoints.
Review your current process, evidence gaps, and next steps for EU Cyber Resilience Act, CRA Product Security and CE Marking Requirements.
Article 24 creates a separate and lighter obligation set for open source software stewards. These entities are not treated identically to manufacturers, but they are not outside the regime entirely.
The details matter if your organisation funds or coordinates open source development that supports commercial products.
Annex II is operationally important because it decides what users need to know in order to install, operate, update, and eventually decommission the product securely. Missing or weak user information makes later incidents and authority inquiries harder to manage.
The support period end date must be clearly and understandably specified at the time of purchase in an easily accessible manner.
If a manufacturer knows or has reason to believe a product or its processes are not in conformity, Article 13 requires immediate corrective measures, withdrawal, or recall as appropriate. This is where technical evidence and product history become critical.
Market surveillance authorities can request information and documentation, and incomplete files or misleading answers create a separate penalty risk.