CRA Enforcement Timeline

The CRA entered into force 10 December 2024. Two obligations apply before the full December 2027 deadline: manufacturers must implement Article 14 vulnerability and incident reporting by 11 September 2026 (21 months), and conformity assessment bodies must be established by 11 June 2026 (18 months, applicable to auditors only). Most requirements Annex I essential cybersecurity requirements, CE marking, and full Annex VII technical documentation apply from 11 December 2027.

From 11 September 2026, manufacturers must report to ENISA and the relevant national CSIRT: an early warning within 24 hours of becoming aware of an actively exploited vulnerability or severe incident; a full vulnerability notification within 72 hours with an initial assessment and any mitigation measures; and a final report within 14 days of a corrective measure becoming available, covering a severity and impact analysis, root cause (where known), and any information about malicious actors. A severe incident is defined as one where the product's ability to protect the availability, authenticity, integrity, or confidentiality of data is compromised, or where malicious code has been introduced and can be executed.

Annex VII requires: a general product description and intended purpose; a cybersecurity risk assessment; design and development documentation including system architecture; a list of harmonised standards applied with gap justifications where coverage is incomplete; security test reports; an EU Declaration of Conformity; a Software Bill of Materials (SBOM) in machine-readable format; details of the vulnerability handling process and CVD policy; and a lifecycle maintenance plan. This pack must be available to market surveillance authorities on reasoned request and retained for at least 10 years from the date of placing on the market.

Yes. Annex I, Part II requires manufacturers to identify and document software components in machine-readable format, covering at minimum top-level software dependencies. The SBOM must be maintained and kept current across the entire product support period, and must be included in the Annex VII technical documentation package. Visure models the SBOM as a set of linked items in the project data model, tracing each component to the security requirements and tests that cover it enabling live impact analysis when a component vulnerability is discovered.

No single standard covers all of Annex I confirmed by the JRC/ENISA Cyber Resilience Act Requirements Standards Mapping report (EUR 31892 EN). The most commonly required combination is: IEC 62443-4-1 for secure product development lifecycle; ETSI EN 303 645 for consumer IoT; ISO/IEC 29147 for vulnerability disclosure; ISO/IEC 30111 for vulnerability handling; ISO/IEC 27001/27002 for ISMS; and ISO/IEC 27005 for risk assessment. Your required combination depends on your product class. Manufacturers must demonstrate combined clause-by-clause Annex I coverage and document any gaps with compensating measures.

The CRA covers cybersecurity requirements for products with digital elements. NIS2 (Directive (EU) 2022/2555) requires organisations in specific industries energy, transport, health, digital infrastructure to secure their networks and information systems against cyberattacks. They are complementary: the CRA governs the product placed on the market, NIS2 governs the organisation operating critical infrastructure. A product manufacturer serving NIS2-regulated sectors may face obligations under both.

Visure provides the requirements authoring, end-to-end traceability, risk management, SBOM data modelling, baseline management with electronic signatures, and Annex VII export infrastructure that makes CRA compliance repeatable. Every Annex I requirement can be traced to a design element and verification test; risks are first-class items linked to mitigations; baselines are electronically signed and can be restored exactly at any future date; and the Annex VII evidence pack is generated from live project data on demand. Vivia AI can accelerate initial security requirements authoring against Annex I clauses, with human-in-the-loop approval before any AI output enters a baseline.