EU Cyber Resilience Act

    The CRA reporting obligation starts 11 September 2026

    A reporting readiness checklist for manufacturers of products with digital elements — including non-EU companies selling into the EU.

    • Who is in scope, and the tests that decide it
    • What has to be reported, to whom, and inside what windows
    • What to have in place before the date, and what can wait until 11 December 2027

    Written by the muVerity practitioners who do this work. It sets out what the instruments require and what we have seen hold up in practice — it is not legal advice, and it does not make an organisation compliant.

    Get the document

    CRA reporting readiness checklist (PDF)

    We email you a link to the checklist. The link expires; request it again any time. Marketing email only goes out if you tick the second box. Read the privacy policy.

    Cyber Resilience Act checklist

    The EU Cyber Resilience Act (Regulation (EU) 2024/2847) applies to products with digital elements sold in the EU. Reporting obligations apply from September 2026 and the main requirements from December 2027. Use this checklist to see where you stand.

    1. 01Confirm which of your products are 'products with digital elements' and whether any fall into the important or critical categories
    2. 02Name the manufacturer, importer or distributor role you hold for each product
    3. 03Run and document a cybersecurity risk assessment for each product
    4. 04Check the essential requirements: secure by default, no known exploitable vulnerabilities at release, access control, data protection, minimal attack surface
    5. 05Produce a software bill of materials (SBOM) for each product
    6. 06Set up a vulnerability handling process and a public point for reporting vulnerabilities
    7. 07Prepare to report actively exploited vulnerabilities and severe incidents to ENISA within 24 hours
    8. 08Define the support period and commit to security updates throughout it
    9. 09Choose the conformity assessment route and prepare technical documentation
    10. 10Plan the EU declaration of conformity and CE marking
    Who it is for

    Teams doing this without a dedicated compliance function

    Most of the organisations we work with have a deadline, a small team, and no one whose only job is this. The document is written for that situation: specific enough to act on, short enough to finish.

    If you would rather talk

    Book time with a practitioner

    A working session on scope, gaps and sequencing — with the person who would do the work, not a sales call.

    Book a consultationSend a message
    Knowledge Center

    Related guides