20 questions manufacturers
really ask about the CRA

Your product is affected if it contains digital elements and can connect to a network. This includes IoT devices, industrial equipment, embedded firmware, operating systems, networking equipment.

Default class: self-assessment allowed, fine up to 7.5M euros. Class I: harmonised standards or notified body required, fine up to 10M euros. Class II: mandatory notified body audit, fine up to 15M euros.

Pure cloud services without a local software component are generally not covered. However, any downloadable application, installed firmware or updateable software is covered.

A compliant SBOM must list all components: open source libraries, commercial software, firmware, and all transitive dependencies. Accepted formats: CycloneDX 1.4+ and SPDX 2.3.

A VEX (Vulnerability Exploitability eXchange) specifies for each CVE whether your product is actually affected. The obligation to communicate on vulnerability exploitability makes it the standard tool.

A PSIRT is the internal process for receiving and responding to security vulnerability reports. The CRA requires a public reporting channel (CVD policy + security@ address) and an internal handling process.

CRA entered into force December 2024. ENISA notification obligations apply from September 2026. Full compliance required by December 2027.

Realistic timelines: SBOM generation 1-4 weeks, CVE monitoring 2-4 weeks, PSIRT setup 2-3 weeks, technical documentation 4-8 weeks. Plan 4-6 months total.

Default class: 7.5M euros or 1.5% of global turnover. Class I: 10M euros or 2%. Class II: 15M euros or 2.5%. Authorities can also order product withdrawal from the EU market.

Each EU member state designates market surveillance authorities. ENISA plays a coordinating role for vulnerability notifications. Enforcement begins from December 2027.

Minimum PSIRT: a public security@ email address, a published CVD policy, a documented internal triage process, a channel for notifying ENISA within 24 hours of actively exploited vulnerabilities.

From September 2026, any actively exploited vulnerability must be notified to ENISA within 24 hours, with a full report within 14 days.