CRA compliance checklist

Phase 1: now (reporting readiness)

1. List all products with digital elements you place on the EU market, including older versions still in use.
2. Determine your role for each (manufacturer, importer, distributor) and check scope, including SaaS components.
3. Assign a responsible owner and deputies for CRA reporting.
4. Register with the ENISA Single Reporting Platform and identify your competent CSIRT.
5. Create an SBOM for each product and keep it current.
6. Set up vulnerability monitoring for your code and dependencies.
7. Publish a contact address for vulnerability reports and a coordinated vulnerability disclosure policy.
8. Write and test a reporting runbook for the 24h / 72h / final report stages.

Phase 2: by 11 December 2027 (full conformity)

1. Classify each product: default, important (Class I/II) or critical.
2. Carry out and document a cybersecurity risk assessment per product.
3. Implement the Annex I Part I requirements (secure defaults, access control, data protection, attack surface, logging, updates).
4. Formalise vulnerability handling per Annex I Part II, including regular testing.
5. Define and publish the support period (at least five years unless expected use is shorter).
6. Compile technical documentation (Annex VII) and user information (Annex II).
7. Perform the conformity assessment (Module A for standard products).
8. Draw up the EU declaration of conformity and affix the CE marking.
9. Keep documentation for ten years or the support period, whichever is longer.

For background, see the CRA overview.