Blog
How to run CRA before an authority asks for the file.
Notes on the product map, risk, documentation and the dates. For a team that must produce evidence, not a presentation.
What 11 September 2026 and 11 December 2027 actually start
Article 14 of the Cyber Resilience Act starts on 11 September 2026. Essential requirements, conformity assessment and the CE mark apply from 11 December 2027. Here is what each date opens, and what must already run before it.
Read ->
CRA is not a vulnerability scanner
The Cyber Resilience Act is a product-safety rule. It asks for a product map, an Annex I risk assessment, an SBOM, a technical file and a CE path. Vulnerability handling is one module, not the regulation.
Read ->
An SBOM under CRA is evidence, not a file you generate once
The Cyber Resilience Act treats the software bill of materials as due diligence on the product you ship. The SBOM has to match the version on the market, feed the vulnerability queue and sit in the technical file.
Read ->
What counts as a product with digital elements under CRA
A product with digital elements is a device, standalone software or a component sold separately, placed on the Union market under your name. CRA applies per product, not once for the company.
Read ->