FREE RESOURCE
CRA Compliance Checklist
20 obligations to verify before 2027
A practical checklist for manufacturers: SBOM, PSIRT, CVE monitoring, technical documentation, notification obligations — downloadable PDF.
What's in the checklist
SBOM obligations (5 items)
Generation, formats, transitive dependencies, update frequency, retention.
Vulnerability management (5)
CVE monitoring, prioritisation, fix/mitigate/accept decisions, traceability.
PSIRT and 24h notification (4)
CVD policy, security@ address, ENISA process, 14-day detailed report.
Technical documentation (3)
CRA technical dossier, support duration declared, CE marking.
Timeline and priorities (3)
September 2026 obligations, December 2027 deadline, action plan.
CRA Compliance Checklist
PDF · 2 pages · Free
Enter your professional email to receive the checklist immediately. No spam — unsubscribe at any time.
Go further
VAST helps structure these 20 obligations
Stop checking boxes manually. VAST generates your SBOM, monitors CVEs, produces VEX and prepares PSIRT notifications automatically.