Cyber Resilience Act compliance checklist: your CRA readiness score

The Cyber Resilience Act gives the manufacturer of a product with digital elements a list of obligations: reporting, security requirements for the product, vulnerability handling and the paperwork. Answer each one for your product to see where you stand and what is still open, with the article for each point.

Checked against the sources on 17 October 2026

Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 13, 14, 69 and 71, Annexes I and II

Checked against the sources on 17 October 2026

Your CRA readiness

Answer each row for one product. The score counts only your answers; nothing is checked, sent or stored.

Reporting (Article 14): applies from 11 September 2026, also to products already on the market

Actively exploited vulnerabilities: early warning within 24 hours, notification within 72 hours, final report no later than 14 days after a fix is available, through the single reporting platform (Article 14(1), (2))
Severe incidents affecting the product's security: early warning within 24 hours, notification within 72 hours, final report within one month of the notification (Article 14(3) to (5))
You know which CSIRT coordinator receives your notifications: the Member State of your main establishment in the EU, or the order of Article 14(7) if you have none (Article 14(7))
Impacted users, and where appropriate all users, are informed of the vulnerability or incident and of the measures they can take (Article 14(8))

Product requirements (Annex I, Part I): from 11 December 2027

Not applicable only where your cybersecurity risk assessment shows it, with the justification in the technical documentation (Article 13(4)).

Security appropriate to the risks (Annex I, Part I(1))
No known exploitable vulnerabilities (Annex I, Part I(2)(a))
Secure by default, with a reset (Annex I, Part I(2)(b))
Security updates, automatic by default (Annex I, Part I(2)(c))
Protection from unauthorised access (Annex I, Part I(2)(d))
Confidentiality of data (Annex I, Part I(2)(e))
Integrity of data, commands and configuration (Annex I, Part I(2)(f))
Data minimisation (Annex I, Part I(2)(g))
Availability of essential functions (Annex I, Part I(2)(h))
Limited impact on other devices and networks (Annex I, Part I(2)(i))
Limited attack surfaces (Annex I, Part I(2)(j))
Exploitation mitigation (Annex I, Part I(2)(k))
Security logging and monitoring, with opt-out (Annex I, Part I(2)(l))
Secure removal of all data and settings (Annex I, Part I(2)(m))

Vulnerability handling (Annex I, Part II): from 11 December 2027

Vulnerabilities and components identified and documented, with a software bill of materials covering at least the top-level dependencies (Annex I, Part II(1))
Vulnerabilities addressed and remediated without delay, with security updates, separate from feature updates where technically feasible (Annex I, Part II(2))
Effective and regular tests and reviews of the product's security (Annex I, Part II(3))
Fixed vulnerabilities disclosed publicly once the security update is available (Annex I, Part II(4))
A coordinated vulnerability disclosure policy, in place and enforced (Annex I, Part II(5))
A contact address for reporting vulnerabilities, and measures to share information about them, including in third-party components (Annex I, Part II(6))
Updates distributed securely, and automatically where applicable for security updates (Annex I, Part II(7))
Security updates disseminated without delay, free of charge (unless agreed otherwise with a business user for a tailor-made product), with advisory messages (Annex I, Part II(8))

Manufacturer obligations (Article 13): from 11 December 2027

Cybersecurity risk assessment done, documented, updated during the support period and included in the technical documentation (Article 13(2) to (4))
Due diligence on third-party and open-source components; vulnerabilities found in them reported to whoever maintains them (Article 13(5), (6))
Support period set from the time the product is expected to be in use: at least five years, unless it is expected to be in use for less (Article 13(8))
Each security update stays available for at least 10 years after it is issued, or for the rest of the support period if that is longer (Article 13(9))
End of the support period, at least month and year, stated clearly at the time of purchase (Article 13(19))
Type, batch or serial number on the product, or on its packaging or an accompanying document where that is not possible (Article 13(15))
Name, postal address and email or other digital contact on the product, its packaging or an accompanying document, and a single point of contact for users (Article 13(16), (17))
Information and instructions to the user (Annex II) with the product, kept available for at least 10 years or for the support period if that is longer (Article 13(18), Annex II)
Technical documentation (Annex VII) drawn up before the product is placed on the market (Article 13(12), Article 31, Annex VII)
Conformity assessment procedure chosen and carried out (Article 32); important and critical products have fewer routes (Article 13(12), Article 32)
EU declaration of conformity drawn up and CE marking affixed; a copy or the simplified declaration supplied with the product (Article 13(12), (20), Articles 28 and 30)
Technical documentation and declaration kept for at least 10 years after the product is placed on the market, or for the support period if that is longer (Article 13(13))

Readiness: 0%

Done: 0 of 38 applicable rows

Not answered: 38 (counted as not done)

By area

Reporting0%
Product requirements0%
Vulnerability handling0%
Manufacturer obligations0%

Still open

Actively exploited vulnerabilities: early warning within 24 hours, notification within 72 hours, final report no later than 14 days after a fix is available, through the single reporting platform (Article 14(1), (2); Not answered) CRA reporting register
Severe incidents affecting the product's security: early warning within 24 hours, notification within 72 hours, final report within one month of the notification (Article 14(3) to (5); Not answered) CRA reporting register
You know which CSIRT coordinator receives your notifications: the Member State of your main establishment in the EU, or the order of Article 14(7) if you have none (Article 14(7); Not answered) CRA reporting register
Impacted users, and where appropriate all users, are informed of the vulnerability or incident and of the measures they can take (Article 14(8); Not answered) CRA reporting register
Security appropriate to the risks (Annex I, Part I(1); Not answered)
No known exploitable vulnerabilities (Annex I, Part I(2)(a); Not answered)
Secure by default, with a reset (Annex I, Part I(2)(b); Not answered)
Security updates, automatic by default (Annex I, Part I(2)(c); Not answered)
Protection from unauthorised access (Annex I, Part I(2)(d); Not answered)
Confidentiality of data (Annex I, Part I(2)(e); Not answered)
Integrity of data, commands and configuration (Annex I, Part I(2)(f); Not answered)
Data minimisation (Annex I, Part I(2)(g); Not answered)
Availability of essential functions (Annex I, Part I(2)(h); Not answered)
Limited impact on other devices and networks (Annex I, Part I(2)(i); Not answered)
Limited attack surfaces (Annex I, Part I(2)(j); Not answered)
Exploitation mitigation (Annex I, Part I(2)(k); Not answered)
Security logging and monitoring, with opt-out (Annex I, Part I(2)(l); Not answered)
Secure removal of all data and settings (Annex I, Part I(2)(m); Not answered)
Vulnerabilities and components identified and documented, with a software bill of materials covering at least the top-level dependencies (Annex I, Part II(1); Not answered) SBOM generator
Vulnerabilities addressed and remediated without delay, with security updates, separate from feature updates where technically feasible (Annex I, Part II(2); Not answered)
Effective and regular tests and reviews of the product's security (Annex I, Part II(3); Not answered)
Fixed vulnerabilities disclosed publicly once the security update is available (Annex I, Part II(4); Not answered)
A coordinated vulnerability disclosure policy, in place and enforced (Annex I, Part II(5); Not answered)
A contact address for reporting vulnerabilities, and measures to share information about them, including in third-party components (Annex I, Part II(6); Not answered)
Updates distributed securely, and automatically where applicable for security updates (Annex I, Part II(7); Not answered)
Security updates disseminated without delay, free of charge (unless agreed otherwise with a business user for a tailor-made product), with advisory messages (Annex I, Part II(8); Not answered)
Cybersecurity risk assessment done, documented, updated during the support period and included in the technical documentation (Article 13(2) to (4); Not answered) CRA document kit (paid)
Due diligence on third-party and open-source components; vulnerabilities found in them reported to whoever maintains them (Article 13(5), (6); Not answered)
Support period set from the time the product is expected to be in use: at least five years, unless it is expected to be in use for less (Article 13(8); Not answered)
Each security update stays available for at least 10 years after it is issued, or for the rest of the support period if that is longer (Article 13(9); Not answered)
End of the support period, at least month and year, stated clearly at the time of purchase (Article 13(19); Not answered)
Type, batch or serial number on the product, or on its packaging or an accompanying document where that is not possible (Article 13(15); Not answered)
Name, postal address and email or other digital contact on the product, its packaging or an accompanying document, and a single point of contact for users (Article 13(16), (17); Not answered)
Information and instructions to the user (Annex II) with the product, kept available for at least 10 years or for the support period if that is longer (Article 13(18), Annex II; Not answered) CRA document kit (paid)
Technical documentation (Annex VII) drawn up before the product is placed on the market (Article 13(12), Article 31, Annex VII; Not answered) CRA document kit (paid)
Conformity assessment procedure chosen and carried out (Article 32); important and critical products have fewer routes (Article 13(12), Article 32; Not answered) CRA class checker
EU declaration of conformity drawn up and CE marking affixed; a copy or the simplified declaration supplied with the product (Article 13(12), (20), Articles 28 and 30; Not answered) CRA document kit (paid)
Technical documentation and declaration kept for at least 10 years after the product is placed on the market, or for the support period if that is longer (Article 13(13); Not answered)

Your own answers, not an assessment: the score does not show that the product meets the Regulation.

What the check covers

Reporting (Article 14): actively exploited vulnerabilities and severe incidents, to the CSIRT designated as coordinator and ENISA through the single reporting platform, and informing users.
The essential cybersecurity requirements for the product (Annex I, Part I): one general requirement and thirteen specific ones.
The vulnerability handling requirements (Annex I, Part II): eight points, including the software bill of materials.
The other obligations of manufacturers (Article 13): risk assessment, components, support period, updates, markings, user information, technical documentation, conformity assessment, declaration and CE marking, and keeping the documents.

Dates

Article 14 (reporting) applies from 11 September 2026, also to products placed on the market before 11 December 2027 (Articles 69(3) and 71(2)).
The rest of the Regulation applies from 11 December 2027. A product placed on the market before that date comes under it only if it is substantially modified from that date (Article 69(2)).

How the score works

Only rows answered “Done” count. “Partly done”, “Not started” and rows left unanswered count as open, so the score never shows more than you answered. “Not applicable” removes a row from the total; it is offered only for the specific requirements of Annex I, Part I, point (2), which apply on the basis of the cybersecurity risk assessment and where applicable, and the technical documentation must say why (Article 13(4)). The percentage is rounded down.

What the check does not do

It does not test or assess your product: the score is a count of your own answers, and a high score does not show that the product meets the Regulation. It covers manufacturers only, not importers (Article 19), distributors (Article 20) or open-source software stewards (Article 24). For the class of your product and its conformity assessment route, use the CRA check; for the reporting deadlines, the CRA reporting register; for the SBOM, the SBOM generator.

Nothing you answer leaves your browser or is saved: reloading the page clears it. Copy or print the result to keep it.

Sources

Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 13, 14, 69 and 71, Annexes I and II