CRA guides

  1. Does the Cyber Resilience Act apply to your product? A 5-minute scope check

    Is your app, plugin, SDK or device covered by the Cyber Resilience Act? A 5-minute scope check with examples, exclusions and what follows if the answer is yes.

  2. Hourglass with sand running against a dark background

    CRA timeline: every deadline from 11 September 2026 to 11 December 2027

    Every CRA deadline from 11 September 2026 to 11 December 2027, plus a quarter-by-quarter plan for small software firms.

  3. White alarm clock on a wooden shelf

    CRA 24-hour reporting: what a micro company selling software must do since 11 September 2026

    Since 11 September 2026 the CRA requires you to report actively exploited vulnerabilities within 24 hours. Who is covered, deadlines, where to report, what to prepare.

  4. Blue and orange shipping containers against a blue sky

    CRA SBOM and technical documentation: what a micro software company must have by 11 December 2027

    What the CRA requires by 11 December 2027: technical documentation (Annex VII), an SBOM of top-level dependencies, 5-year support and CE marking.

  5. White puzzle pieces on a blue background

    CRA for WordPress plugins and Shopify apps: are you a manufacturer?

    Selling a premium WordPress plugin, a theme or a Shopify app in the EU? When you are a CRA manufacturer, what about freemium and marketplaces, and what to do now.

  6. Green circuit board with microchips and capacitors

    CRA for connected devices and firmware: security updates and support period

    Selling a connected device with firmware in the EU? What the CRA requires: 24h reporting now, a 5-year support period, security updates and CE from Dec 2027.

  7. Laptop showing colourful source code in a dark room

    CRA and open source: your dependencies are your responsibility

    Using open-source libraries in a paid product? Under the CRA their vulnerabilities are your responsibility. Who is in scope, what stewards do, and what you must do.

  8. Network switch with ethernet ports and status lights

    Important and critical products under the CRA: is yours in Annex III or IV?

    Is your product in Annex III or IV of the CRA? The 19 Class I and 4 Class II categories, the core functionality rule, and why Class I may need a notified body in 2027.

  9. Rubber stamps with wooden, black and red handles on a stand

    CE marking under the CRA: self-assessment and the EU declaration of conformity

    Self-assessing your product under the CRA? The four steps of module A, what goes in the EU declaration of conformity, and where software puts the CE marking.

  10. Close-up of multicoloured code lines on a screen

    Free SBOM generators compared: Syft, Trivy, cdxgen - and what the CRA still needs

    Syft, Trivy, cdxgen or Microsoft SBOM Tool? A fair comparison of free SBOM generators, the formats the CRA expects, and the work the tools leave to you.

  11. Stacks of euro coins in close-up

    CRA fines: what a micro company actually risks

    CRA fines go up to 15 million EUR, but what does a micro company actually risk? The three tiers, the micro exemption, how fines are set and what else authorities can do.