& Notare
CRA manufacturer obligations: what to start now.
Reporting already applies. Everything else must be in place for products placed on the EU market from 11 December 2027. Most of it takes months, so the work starts now.
A product-specific risk assessment, secure design under Annex I, vulnerability handling with an SBOM and free security updates for the support period, technical documentation, user information, a conformity assessment, the EU declaration of conformity and CE marking (Arts. 13, 28–32). Reporting under Art. 14 applies since 11 September 2026.
Status: November 2026 · Regulation (EU) 2024/2847 and Commission guidance
Three phases until December 2027
- Single point of contact. Name a contact that can act within 24 hours and publish a security contact address. Art. 13(17)
- Coordinated vulnerability disclosure. Adopt a CVD policy: intake address, acknowledgement, embargo rules, how fixes are shared. Annex I Part II(5), (6)
- Reporting procedure. Initial assessment, documented moment of awareness, 24 h early warning, 72 h notification, final report. Art. 14
- Competent CSIRT. For non-EU makers the CSIRT follows your authorised representative, importer or distributor. Set up access to the ENISA single reporting platform. Art. 14(7), 16
- Product register. Per product: network connection, sales channel, brand, price model, role (manufacturer, steward, out of scope) and class. Arts. 2, 3, 7, 8
- Risk assessment. Product-specific assessment before placing on the market; it decides which Annex I requirements apply and why others do not. Art. 13(2), (3)
- SBOM and component due diligence. Machine-readable SBOM (SPDX or CycloneDX), at least top-level dependencies; due diligence on third-party and open-source components. Art. 13(5); Annex I Part II(1)
- Support period. Set it to reflect expected use, normally at least five years; publish the end date; deliver security updates free of charge, separately from feature updates where feasible. Art. 13(8), (9); Annex I Part II(2), (8)
- Annex I product properties. Secure by default, no known exploitable vulnerabilities, access control, encryption, integrity, data minimisation, small attack surface, logging, secure deletion. Annex I Part I
- Technical documentation. Content per Annex VII including the risk assessment; keep it for at least ten years. Micro and small enterprises may use a simplified form. Arts. 13(12), (13), 31, 33(5); Annex VII
- User information. Manufacturer contact, security contact, intended use, foreseeable risks, end of support period, secure set-up and decommissioning. Art. 13(18); Annex II
- Conformity assessment, declaration, CE. Default category: internal control (Module A). Important and critical products need stricter procedures. Then EU declaration of conformity and CE marking. Arts. 28–32; Annexes III, IV, V, VIII
Points that are often missed
Products placed on the market before 11 December 2027 need no retrofit until a substantial modification. The Commission reads this per unit, not per product type, and reporting applies to them anyway.
Art. 69(2), (3); Commission FAQ
Security updates must be free during the support period and remain available for ten years. Paid-only support for older versions needs rethinking.
Art. 13(8), (9); Annex I Part II(8)
Until standards are cited in the Official Journal there is no presumption of conformity. Your risk assessment and documentation carry the burden.
Art. 27
Up to EUR 15 million or 2.5 % of worldwide turnover for breaches of Annex I and Arts. 13 and 14; up to EUR 10 million or 2 % for other obligations.
Art. 64(2), (3)
Start with a fixed-fee check
We map your products, your role and the measures you need, with priorities and dates. First call of 30 minutes at no charge.
Rechtsanwalt (German attorney) at SES in Berlin. Advises international technology consortia and software makers on the Cyber Resilience Act.