Manufacturer
The person who places the PDE on the market under their name. Primary addressee: design, risk, SBOM, support, documentation, CE, notifications.
Regulation (EU) 2024/2847
What CRA asks of a manufacturer, with dates.
The Cyber Resilience Act is a horizontal framework for hardware and software made available on the Union market. The facts below come from the text, not from a law-firm memo.
Who it covers
The primary addressee is the manufacturer: the person who places a product with digital elements on the market under their name or trademark. Importers and distributors carry duties too. A product with digital elements is a device or standalone software, including components placed on the market separately.
Roles in the chain
Importer
Places a non-EU product on the Union market. Must check the manufacturer did their part and keep the file.
Distributor
Makes the product available further down. Checks marking, instructions and whether CE is there at all.
Authorised representative
May be appointed for authority contact. Does not take the risk assessment or Annex I off the manufacturer.
Dates
-
10 December 2024
Entry into force
The regulation is in force. Full application of the essential requirements comes later.
-
11 June 2026
Conformity-assessment bodies
The rules on notifying conformity-assessment bodies start to apply.
-
11 September 2026
Article 14 notifications
Manufacturers notify actively exploited vulnerabilities and severe incidents: early warning in 24 hours, full notification in 72 hours, then a final report.
-
11 December 2027
Essential requirements and CE
A product placed on the market must meet Annex I, complete conformity assessment, carry an EU declaration and the CE mark. Risk assessment, documentation, SBOM and the support period must be maintained.
Annex I in short
Part I - product properties
An appropriate level of cybersecurity for the risk. No known exploitable vulnerabilities at placing on the market. Secure defaults. Updates, including automatic ones with a clear opt-out. Access control, integrity, confidentiality, attack-surface reduction, data minimisation.
Part II - vulnerability handling
Identify and document vulnerabilities, including an SBOM. Patch during the support period. Tests. A public disclosure policy. Coordinated disclosure. Fixes without undue delay. Article 14 keeps a separate notification clock.
The Article 14 clock
24h
Early warning from the moment you know of an actively exploited vulnerability or a severe incident.
72h
Full notification. One channel (SRP), to the CSIRT of the main establishment, and to ENISA.
14 days / 1 month
Final report: 14 days after a fix for a vulnerability, one month after the 72h notice for an incident.
What a manufacturer must be able to show
- A cybersecurity risk assessment across the lifecycle, not only before launch.
- No known exploitable vulnerabilities at placing on the market, and a secure-by-default configuration.
- Security updates, including automatic updates where that makes sense, with a clear opt-out.
- Due diligence on third-party components.
- A support period stated at purchase, with month and year.
- Technical documentation available to market-surveillance authorities.
- Notifications through the single reporting platform to the CSIRT of the main establishment and to ENISA.
Source: Regulation (EU) 2024/2847 and the European Commission summary.
Questions you will ask anyway
Is Crado AI a vulnerability scanner?
No. Vulnerabilities and the Article 14 clock are one module. The system runs the product map (PDE), risk assessment and Annex I, SBOM, the technical file and the CE path.
Does standalone software fall under CRA?
Yes, if you place it on the Union market under your name or trademark. A PDE is not only a box of electronics.
What happens on 11 September 2026?
Article 14 applies: actively exploited vulnerabilities and severe incidents. Early warning in 24 hours, full notification in 72 hours, then a final report. Through the single platform to the CSIRT of the main establishment and to ENISA.
And 11 December 2027?
Annex I essential requirements, conformity assessment, EU declaration and CE mark when placing on the market. Risk assessment, SBOM, documentation and the support period must already be running.
Is this a cloud?
No. You install Crado AI on your site. The SBOM and the technical file do not land on our server.
Do you replace a notified body?
No. The system collects evidence and runs the process. Conformity assessment stays yours.
How many products can it cover?
From a handful of SKUs to a catalogue in the hundreds. On the call we ask how many PDEs you have and whether an SBOM already comes from the pipeline.
Where do the mock data come from?
A fictional catalogue (Gate-240, Lens OS). It shows interface density, not a customer.
Where does the form go?
To hello@crado.eu. We reply to the address you give.