CRA Obligations Checker

Manufacturers carry the fullest set of CRA obligations. They must: conduct a cybersecurity risk assessment; meet the essential security requirements in Annex I (no known exploitable vulnerabilities, minimal attack surface, authentication, secure defaults, secure update mechanism, and more); produce and maintain a Software Bill of Materials (SBOM); establish a vulnerability handling process and a coordinated vulnerability disclosure (CVD) policy; provide security updates for the product lifetime (at least five years); complete the required conformity assessment for their product class; affix the CE marking; issue an EU Declaration of Conformity; draw up technical documentation; and report actively exploited vulnerabilities and significant incidents to the ENISA Single Reporting Platform once Art. 14 applies from 11 Sep 2026.

An SBOM is a formal, machine-readable list of all software components in a product - direct dependencies and transitive (indirect) ones - along with version numbers and origin information. All manufacturers of products with digital elements must produce and maintain an SBOM under the CRA. It must be available to market surveillance authorities on request. Common formats are SPDX (ISO/IEC 5962) and CycloneDX. The SBOM is closely linked to the vulnerability handling obligation: if a component appears in a known-vulnerability database (such as the NVD or OSV), the manufacturer must act.

No. Neither importers nor distributors conduct their own conformity assessment. The manufacturer is responsible for the conformity assessment, CE marking, and EU Declaration of Conformity. Importers must verify this work has been done before placing the product on the EU market - checking the CE marking, EU DoC, and that technical documentation is in place. Distributors must verify the CE marking and documentation before making the product available. If either role modifies the product substantially or markets it under their own name, they become the manufacturer and take on all manufacturer obligations.

Two key dates. The vulnerability and incident reporting obligations under Article 14 - requiring manufacturers to notify ENISA of actively exploited vulnerabilities and significant cybersecurity incidents - apply from 11 September 2026. All other CRA obligations, including the essential requirements, conformity assessment, CE marking, SBOM, and security update duties, apply from 11 December 2027. Unlike some other EU regulations, the CRA does not have a company-size-based deadline difference; both dates apply to all companies. Micro and small enterprises may access simplified conformity procedures under harmonised standards.

The CRA sets substantial fines. For failure to meet the essential cybersecurity requirements: up to €15 million or 2.5% of total worldwide annual turnover (whichever is higher). For other obligations (documentation, reporting, cooperation with market surveillance): up to €10 million or 2% of annual turnover. For providing incorrect or misleading information to authorities: up to €5 million or 1% of annual turnover. Open-source software stewards cannot be fined under this regime.