# CRA Evidence

> EU Cyber Resilience Act (CRA) compliance platform — verifiable evidence for manufacturers, importers, and distributors. CRA Evidence helps hardware manufacturers, IoT vendors, and digital product teams meet Regulation 2024/2847 requirements: manage SBOMs and HBOMs, track vulnerabilities with EPSS and CISA KEV prioritisation, author VEX statements, run Article 14 ENISA reporting workflows, and generate Annex VII technical files and EU Declarations of Conformity for products with digital elements sold in the EU.

## About

SaaS-first B2B compliance platform for manufacturers, importers, and distributors of products with digital elements across consumer IoT, industrial automation (OT), connected machinery, smart cameras, connected home, EV charging, radio/wireless equipment, and embedded software. CRA Evidence also offers scoped consulting services for implementation planning, programme leadership, and authority or incident-response readiness. The platform covers SBOM management (CycloneDX 1.4/1.5/1.6, SPDX 2.3), an in-house Vulnerability Knowledge Base (VKB), automated VEX authoring, Annex II User Information & Instructions (UII), Digital Product Passports, Article 14 ENISA reporting workflows, Annex VII technical files, Coordinated Vulnerability Disclosure, and dual-compliance for machinery (Regulation 2023/1230 §1.1.9). Firmware analysis via EMBA. Aligned with NIS2, the Radio Equipment Directive (RED), and the Machinery Regulation. Available in English, Spanish, German, French, Italian, Polish, Dutch, Swedish, Japanese, Korean, Traditional Chinese, and Turkish.

## Platform Capabilities

- **SBOM Management**: ingest CycloneDX 1.4+ and SPDX 2.3+, scored against BSI TR-03183 quality levels, with HBOM support covering 15 hardware component types (sensors, actuators, microcontrollers, etc.) for embedded systems
- **Vulnerability Knowledge Base (VKB)**: in-house knowledge base syncing the CVE List hourly and advisory feeds daily from NVD / cvelistV5, OSV.dev, GitHub Security Advisories, CISA KEV, and EPSS — with an independent scanner providing a second detection layer
- **Exploit-driven prioritisation**: every finding enriched with EPSS from FIRST.org (30-day exploitation likelihood) and CISA KEV flags, so remediation follows real-world exploitation evidence rather than raw CVSS
- **VEX automation**: CycloneDX VEX statements generated per finding and published downstream, so non-exploitable CVEs are documented machine-readably
- **Annex II UII wizard**: draft, validate, and publish User Information & Instructions (UII) documents; export to PDF, Markdown, or HTML
- **Technical file generation**: Annex VII packages, EU Declarations of Conformity, and CE-marking records produced as PDF exports
- **ENISA reporting workflow**: structured 24h / 72h / 14d notification timelines with deadline tracking and submission receipts
- **Supplier portal**: customer-facing SBOM and conformity collection with access control — importers and distributors can verify upstream compliance before placing products on the EU market
- **CI/CD integration**: CLI tool to publish SBOMs, HBOMs, VEX, and release metadata directly from build pipelines
- **Digital Product Passports (DPP)**: dynamic publicly accessible passports per product version, QR-linked, with JSON-LD and PDF export for physical product labelling

## CRA Key Facts

- Regulation: EU Cyber Resilience Act (Regulation 2024/2847)
- Entered into force: 10 December 2024
- Reporting obligations (Article 14): 11 September 2026
- Main obligations: 11 December 2027
- Scope: products with digital elements on the EU market
- Excludes: pure SaaS, medical devices (MDR), vehicles, aviation

## Platform & Services

- [CRA Compliance Guide](https://craevidence.com/cra-compliance): hub page for CRA requirements, roles, and deadlines
- [Platform overview](https://craevidence.com/platform): SBOM management, vulnerability scanning, technical file generation, compliance dashboards
- [Consulting services](https://craevidence.com/services): scoped implementation support around the SaaS platform — Technical Readiness Sprint, Programme Lead, Authority & Incident Response Plan
- [Service-provider partners](https://craevidence.com/partners/service-providers): CRA Evidence platform for MSPs, MSSPs, security consultancies, vCISOs, compliance advisers, and authorised representatives supporting client CRA evidence, SBOM, vulnerability workflow, technical file, and reporting-readiness programmes
- [Authorised Representative (Article 18)](https://craevidence.com/cra-compliance/authorised-representative): Article 18 explainer — AR appointment is optional under CRA Article 18(1) (unlike MDR Article 11 or RED Article 5); what an AR can and cannot do under Article 18(3) and 18(2), parallel Article 19 importer role, and selection criteria
- [Representante autorizado (artículo 18)](https://craevidence.com/es/cumplimiento-cra/representante-autorizado): explicación del artículo 18 en español — la designación del representante autorizado es opcional según el artículo 18, apartado 1, del Reglamento (UE) 2024/2847; funciones del artículo 18, apartado 3, obligaciones indelegables del apartado 2, y relación con el importador del artículo 19
- [Représentant autorisé (article 18)](https://craevidence.com/fr/conformite-cra/representant-autorise) : explication de l'article 18 en français. La désignation d'un représentant autorisé est facultative au titre de l'article 18, paragraphe 1, du règlement (UE) 2024/2847 ; tâches de l'article 18, paragraphe 3, obligations indélégables du paragraphe 2 et articulation avec l'importateur de l'article 19
- [Tillverkarens representant (artikel 18)](https://craevidence.com/sv/cra-efterlevnad/tillverkarens-representant): artikel 18 i cyberresiliensförordningen, förklarad på svenska — att utse tillverkarens representant är frivilligt enligt artikel 18.1 i Förordning (EU) 2024/2847; uppgifter enligt artikel 18.3, skyldigheter som inte får delegeras enligt artikel 18.2 och förhållandet till importören enligt artikel 19
- [Bevollmächtigter (Artikel 18)](https://craevidence.com/de/cra-konformitaet/bevollmaechtigter): Artikel 18 des Cyber Resilience Act auf Deutsch erklärt, die Benennung eines Bevollmächtigten ist nach Artikel 18 Absatz 1 der Verordnung (EU) 2024/2847 freiwillig; Aufgaben nach Artikel 18 Absatz 3, nicht delegierbare Pflichten nach Absatz 2 und Verhältnis zum Einführer nach Artikel 19
- [Rappresentante autorizzato (articolo 18)](https://craevidence.com/it/conformita-cra/rappresentante-autorizzato): scheda esplicativa dell'articolo 18 in italiano, la nomina del rappresentante autorizzato è facoltativa ai sensi dell'articolo 18, paragrafo 1, del Regolamento (UE) 2024/2847; compiti dell'articolo 18, paragrafo 3, obblighi non delegabili del paragrafo 2, e relazione con l'importatore dell'articolo 19
- [Upoważniony przedstawiciel (Artykuł 18)](https://craevidence.com/pl/zgodnosc-cra/upowazniony-przedstawiciel): wyjaśnienie Artykułu 18 po polsku, wyznaczenie upoważnionego przedstawiciela jest opcjonalne na podstawie Artykułu 18 ust. 1 Rozporządzenia (UE) 2024/2847; obowiązki z Artykułu 18 ust. 3, obowiązki niepodlegające delegowaniu z ust. 2 i związek z importerem z Artykułu 19
- [Gemachtigde vertegenwoordiger (artikel 18)](https://craevidence.com/nl/cra-naleving/gemachtigde-vertegenwoordiger): artikel 18 van de Cyberweerbaarheidsverordening, uitgelegd in het Nederlands. Het aanwijzen van een gemachtigde vertegenwoordiger is facultatief op grond van artikel 18, lid 1, van Verordening (EU) 2024/2847; taken uit artikel 18, lid 3, niet-delegeerbare verplichtingen uit lid 2 en de verhouding tot de importeur van artikel 19
- [EU認定代理人（CRA第18条）](https://craevidence.com/ja/cra-authorised-representative): EUサイバーレジリエンス法第18条の解説（日本語）。EU認定代理人の選任はCRA第18条第1項により任意であり、MDR第11条やRED第5条のように域外製造業者に義務付けられているものではない。第18条第3項に定める認定代理人の業務、第18条第2項により委任できない義務、および第19条の輸入業者との関係を整理する
- [EU 공인대리인 (CRA 제18조)](https://craevidence.com/ko/cra-authorised-representative): EU 사이버 복원력법 제18조 해설(한국어). EU 공인대리인 선임은 CRA 제18조 제1항에 따라 임의이며, MDR 제11조 또는 RED 제5조처럼 역외 제조업체에 의무로 부과되지 않는다. 제18조 제3항의 공인대리인 업무, 제18조 제2항으로 위임할 수 없는 의무, 제19조 수입업자와의 관계를 정리한다
- [EU 授權代表（CRA 第 18 條）](https://craevidence.com/zh-tw/cra-authorised-representative)：歐盟網路韌性法第 18 條解說（繁體中文）。EU 授權代表的選任依 CRA 第 18 條第 1 項採任意制，與 MDR 第 11 條或 RED 第 5 條對非 EU 製造商的強制要求不同。整理第 18 條第 3 項的授權代表業務、第 18 條第 2 項不得委任的義務、第 19 條進口商的關係
- [AB Yetkili Temsilcisi (CRA Madde 18)](https://craevidence.com/tr/cra-authorised-representative): AB Siber Dayanıklılık Yasası Madde 18 açıklaması (Türkçe). AB Yetkili Temsilcisi atanması CRA Madde 18(1) uyarınca opsiyoneldir; MDR Madde 11 veya RED Madde 5'in aksine AB dışı imalatçılar için zorunlu değildir. Madde 18(3) görevleri, Madde 18(2) ile devredilemeyen yükümlülükler ve Madde 19 ithalatçı ile ilişkisi derlenmiştir
- [Machinery manufacturers hub](https://craevidence.com/machinery-manufacturers): dual-compliance guidance for EU Machinery Regulation (2023/1230) §1.1.9 and the CRA
- [Pricing](https://craevidence.com/pricing): Professional and Enterprise tiers — split by role (Manufacturer, Importer, Distributor); 14-day free trial covers every feature, no credit card required
- [Free tool — CRA Applicability Check](https://craevidence.com/free-tools/cra-applicability-check): interactive questionnaire to determine if the CRA applies to your product
- [Free tool — CRA Role Quiz](https://craevidence.com/free-tools/cra-role-quiz): identify your supply-chain role (manufacturer, importer, distributor)
- [Blog index](https://craevidence.com/blog): CRA guides, regulator coverage, and analyses
- [CRA glossary](https://craevidence.com/glossary): definitions of CRA, SBOM, VEX, HBOM, CVD, ENISA, Notified Body, and related terms
- [About](https://craevidence.com/about): company background and mission
- [Security](https://craevidence.com/security): platform security posture and controls
- [Contact](https://craevidence.com/contact): sales, support, and roadmap-call booking

## CRA Compliance Guides

- [EU Declaration of Conformity (Article 28, Annex V)](https://craevidence.com/cra-compliance/declaration-of-conformity): mandatory legal document, required elements, complete template, Simplified EU DoC (Annex VI), multi-regulation combined DoC
- [Conformity Assessment (Module A vs B+C vs H)](https://craevidence.com/cra-compliance/conformity-assessment): which module applies to Default / Class I / Class II / Critical products, Notified Body requirements, self-assessment eligibility
- [Cybersecurity Risk Assessment (Article 13)](https://craevidence.com/cra-compliance/risk-assessment): how to perform and document the mandatory risk assessment, applicability mapping of all 13 Annex I Part I requirements, worked example, copyable skeleton
- [Technical Documentation (Annex VII)](https://craevidence.com/cra-compliance/technical-documentation): what goes in each section of the technical file, templates, retention requirements, common mistakes
- [Product Classification (Default / Important / Critical)](https://craevidence.com/cra-compliance/product-classification): Annex III and IV lists, multi-function product rules, conformity assessment route by category
- [Products reference hub](https://craevidence.com/cra-compliance/products): published product-specific CRA classification guides; draft product examples remain unpublished until reviewed
- [Industrial robots and cobots under the CRA](https://craevidence.com/cra-compliance/products/industrial-robots-and-cobots): 6-axis arm and collaborative robot classification, Machinery Regulation overlap, ISO 10218-1:2025 cyber-safety boundary, integrator handover evidence, and conformity route
- [Security cameras under the CRA](https://craevidence.com/cra-compliance/products/security-cameras): smart-home Important Class I planning, CCTV and NVR variant split, worked threat model with ONVIF/RTSP and P2P SDK risks, signed-update and support-period evidence, and importer/distributor handoff
- [Routers, modems and switches under the CRA](https://craevidence.com/cra-compliance/products/routers-and-modems): Important Class I item 12 boundary, the RED to CRA cybersecurity transition, WAN/LAN/Wi-Fi and remote-management (TR-069/USP) attack surface, signed-update evidence, and ISP/private-label handoff
- [Smart meter gateways under the CRA](https://craevidence.com/cra-compliance/products/smart-meter-gateways-energy-metering): the only Annex IV Critical energy product, the Article 32(4) conformity route a Critical product must take, the LMN/HAN/WAN gateway architecture and security module, key-lifecycle and metering-privacy evidence, and the importer and utility handoff
- [SBOM Requirements (CycloneDX, SPDX, BSI TR-03183, HBOM)](https://craevidence.com/cra-compliance/sbom): mandatory SBOM fields, format requirements, BSI TR-03183 quality levels, hardware bill of materials for embedded products
- [Importer Obligations (Article 19, Article 3(13) role boundaries)](https://craevidence.com/cra-compliance/importer): step-by-step pre-market verification, when rebranding or substantial modification reclassifies you as the manufacturer under Article 3(13), 10-year DoC retention
- [Support Period (Article 13(8), five-year minimum (shorter only where the expected use time is shorter), end-of-life planning)](https://craevidence.com/cra-compliance/support-period): when the clock starts, what counts as a security update, Annex II support-period end date disclosure, Article 14 interaction during and after support, end-of-life phase-out obligations

## CRA Fundamentals

- [Implementation timeline 2024-2027](https://craevidence.com/blog/cyber-resilience-act-implementation-timeline-2027)
- [Compliance cost estimation framework](https://craevidence.com/blog/cra-compliance-cost-estimation)
- [Penalties and market surveillance](https://craevidence.com/cra-compliance/penalties-and-enforcement)

## SBOM, HBOM & Vulnerability Management

- [SBOM requirements under the CRA](https://craevidence.com/cra-compliance/sbom/cra-requirements)
- [How to generate a CRA-compliant SBOM (tools, formats, CI/CD)](https://craevidence.com/blog/cra-sbom-generation-guide-tools-cicd)
- [Firmware SBOM generation (Yocto, Buildroot, EMBA, Syft)](https://craevidence.com/blog/how-to-generate-firmware-sbom)
- [BSI TR-03183 SBOM quality levels](https://craevidence.com/cra-compliance/sbom/bsi-tr-03183)
- [HBOM (Hardware Bill of Materials) guide](https://craevidence.com/cra-compliance/sbom/hbom)
- [VEX (Vulnerability Exploitability eXchange) guide](https://craevidence.com/blog/cra-vex-vulnerability-exploitability-guide)
- [ENISA 24-hour vulnerability reporting (from 11 Sept 2026)](https://craevidence.com/cra-compliance/vulnerability-reporting)
- [Coordinated Vulnerability Disclosure policy template](https://craevidence.com/cra-compliance/coordinated-vulnerability-disclosure)
- [security.txt setup for CRA](https://craevidence.com/blog/cra-security-txt-setup-guide)

## Industry Verticals

- [Industrial automation & OT — IEC 62443 alignment](https://craevidence.com/blog/cra-industrial-automation-iec-62443-guide)
- [Automotive suppliers — UN R155/R156 and aftermarket](https://craevidence.com/blog/cra-automotive-suppliers-guide)
- [Consumer IoT — EN 303 645 alignment](https://craevidence.com/blog/cra-consumer-iot-en-303-645-guide)
- [Smart cameras — Annex III Important Products](https://craevidence.com/cra-compliance/products/security-cameras)
- [Startups — lean compliance for resource-constrained teams](https://craevidence.com/blog/cra-startups-compliance-guide)

## Roles & Supply Chain

- [Importer obligations and Article 3(13) role boundaries](https://craevidence.com/cra-compliance/importer)
- [Distributor checklist — Article 20 verification](https://craevidence.com/blog/cra-distributor-checklist-verification-steps)
- [Multi-role compliance (manufacturer + importer + distributor)](https://craevidence.com/blog/cra-multi-role-compliance)
- [Supply chain and third-party components (hub)](https://craevidence.com/cra-compliance/supply-chain)
- [Integrate a component or import a product?](https://craevidence.com/cra-compliance/supply-chain/third-party-components-integrate-or-import)
- [Supplier due-diligence questionnaire](https://craevidence.com/cra-compliance/supply-chain/supplier-due-diligence)
- [White-label and OEM — who is the manufacturer?](https://craevidence.com/cra-compliance/supply-chain/white-label-oem)

## National Regulators (EU)

- [Spain — INCIBE-CERT](https://craevidence.com/blog/cra-spanish-manufacturers-incibe-guide)
- [France — ANSSI](https://craevidence.com/blog/cra-french-manufacturers-anssi-guide)
- [Italy — ACN and CSIRT Italia](https://craevidence.com/blog/cra-italian-manufacturers-acn-guide)
- [Netherlands — NCSC-NL](https://craevidence.com/blog/cra-dutch-manufacturers-ncsc-nl-guide)
- [Poland — NASK / CERT Polska](https://craevidence.com/blog/cra-polish-manufacturers-nask-guide)

## Standards & Regulation Overlap

- [CRA vs NIS2](https://craevidence.com/blog/cra-nis2-overlap-guide)
- [CRA vs ISO 27001](https://craevidence.com/blog/cra-iso-27001-comparison-guide)
- [CRA vs UK PSTI](https://craevidence.com/blog/cra-uk-psti-comparison-guide)
- [Cybersecurity Act 2 (January 2026 proposal)](https://craevidence.com/blog/cra-cybersecurity-act-2-supply-chain-certification)

## ENISA & Commission (2026)

- [Commission guidance July 2026 (C(2026) 5252)](https://craevidence.com/blog/cra-commission-guidance-july-2026)
- [Commission guidance March 2026 (Ares(2026)2319816) — superseded draft](https://craevidence.com/blog/cra-commission-guidance-march-2026)
- [ENISA Secure-by-Design Playbook v0.4](https://craevidence.com/blog/enisa-secure-by-design-playbook-cra)
- [ECSMAF v3.0 — EU cybersecurity market framework](https://craevidence.com/blog/enisa-ecsmaf-market-framework-cra-strategy)
- [EUDI Wallet certification — lessons for CRA conformity](https://craevidence.com/blog/enisa-eudiw-wallet-certification-cra-conformity)
- [European Cybersecurity Certification Conference, 15 April 2026](https://craevidence.com/blog/enisa-certification-conference-2026)
- [ENISA onboards its first CNAs — CRA Article 14 reporting chain](https://craevidence.com/blog/enisa-first-cnas-cra-article-14)
- [ENISA NCAF 2.0 — April 2026 update for CRA manufacturers](https://craevidence.com/blog/enisa-ncaf-2-national-capabilities-assessment-2026)
- [ENISA Technology and Innovation Radar — CRA methodology](https://craevidence.com/blog/enisa-technology-innovation-radar-methodology-cra)

## Japanese Market

- [Japanese consulting services](https://craevidence.com/ja/services): four-phase engagement (Assessment, Workflow Integration, Documentation, Ongoing Support)
- [Japanese manufacturer FAQ](https://craevidence.com/ja/faq): 14 questions on JC-STAR / IEC 62443 / ISMS / JCMVP / CC mapping and EU Authorised Representative selection
- [JC-STAR vs EU CRA gap analysis](https://craevidence.com/ja/blog/jc-star-eu-cra-gap-analysis)
- [Article 14 ENISA reporting for Japanese manufacturers](https://craevidence.com/ja/blog/cra-article14-enisa-reporting-japanese-manufacturers)
- [CRA product classification (Japanese)](https://craevidence.com/ja/blog/cra-product-classification-guide)
- [Industrial robot / FA manufacturer guide (Japanese)](https://craevidence.com/ja/blog/cra-nihon-sangyo-robot-fa-manufacturers-guide)
- [Japan semiconductor equipment firmware guide](https://craevidence.com/ja/blog/cra-japan-semiconductor-equipment-firmware-guide)

## Korean Market

- [Korean consulting services](https://craevidence.com/ko/services)
- [Korean manufacturer FAQ](https://craevidence.com/ko/faq)
- [EU CRA for Korean manufacturers](https://craevidence.com/ko/blog/eu-cra-korean-manufacturers-guide)
- [Samsung/LG ecosystem — Korean suppliers guide](https://craevidence.com/ko/blog/cra-samsung-lg-ecosystem-korean-suppliers-guide)
- [ISMS-P to CRA bridge](https://craevidence.com/ko/blog/isms-p-cra-bridge)
- [CRA Article 14 ENISA reporting (Korean manufacturers)](https://craevidence.com/ko/blog/cra-article14-enisa-reporting-korean-manufacturers)
- [Korea semiconductor and memory components guide](https://craevidence.com/ko/blog/cra-korea-semiconductor-memory-components-guide)
- [CRA product classification (Korean)](https://craevidence.com/ko/blog/cra-product-classification-guide)

## Taiwan Market

- [Taiwan consulting services](https://craevidence.com/zh-tw/services)
- [Taiwan manufacturer FAQ](https://craevidence.com/zh-tw/faq)
- [EU CRA for Taiwan manufacturers](https://craevidence.com/zh-tw/blog/eu-cra-taiwan-manufacturers-guide)
- [Taiwan networking and IoT manufacturers](https://craevidence.com/zh-tw/blog/cra-taiwan-networking-iot-manufacturers-guide)
- [Taiwan ODM SBOM supply-chain guide](https://craevidence.com/zh-tw/blog/cra-taiwan-odm-sbom-supply-chain-guide)
- [Taiwan AI server and datacenter hardware guide](https://craevidence.com/zh-tw/blog/cra-taiwan-ai-server-datacenter-hardware-guide)
- [CRA Article 14 ENISA reporting (Taiwan manufacturers)](https://craevidence.com/zh-tw/blog/cra-article14-enisa-reporting-taiwan-manufacturers)
- [CRA product classification (Traditional Chinese)](https://craevidence.com/zh-tw/blog/cra-product-classification-guide)

## Turkish Market

- [Turkish consulting services](https://craevidence.com/tr/services)
- [Turkish manufacturer FAQ](https://craevidence.com/tr/faq)
- [CE marking guide for Turkish exporters](https://craevidence.com/tr/blog/cra-ce-isareti-turk-ihracatci-kilavuzu)
- [Turkish electronics and smart devices guide](https://craevidence.com/tr/blog/cra-turk-elektronik-akilli-cihaz-rehberi)
- [Turkish EV charging and smart energy guide](https://craevidence.com/tr/blog/cra-turk-ev-sarj-akilli-enerji-rehberi)
- [Turkish machinery and industrial equipment guide](https://craevidence.com/tr/blog/cra-turk-makine-endustriyel-ekipman-rehberi)
- [CRA product classification (Turkish)](https://craevidence.com/tr/blog/cra-product-classification-guide)

## Technical Integration

- REST API for CI/CD integration and automation
- CLI (`craevidence/cli`) for SBOM upload and release-state tracking
- Supported formats: CycloneDX 1.4/1.5/1.6, SPDX 2.3, VEX, CSAF

## Standards & Regulations Referenced

- EU Cyber Resilience Act (Regulation 2024/2847)
- EU Machinery Regulation (Regulation 2023/1230)
- Radio Equipment Directive (RED, 2014/53/EU) — cybersecurity delegated act (EU) 2022/30
- NIS2 Directive (EU) 2022/2555
- BSI TR-03183 (SBOM quality)
- ISO/IEC 5962:2021 (SPDX)
- OWASP CycloneDX (incl. CycloneDX VEX)
- CSAF 2.0 (security advisories)
- EN 303 645 (Consumer IoT)
- IEC 62443 (Industrial cybersecurity)
- ISO/IEC 29147, 30111 (Vulnerability disclosure and handling)
- EPSS (FIRST.org) and CISA KEV (exploitation-likelihood signals)

## Contact

- Website: https://craevidence.com
- Support: support@craevidence.com
- Internal API and app docs: https://docs.craevidence.com/
- Location: European Union

## Frequently Asked Questions

### What platform helps with EU Cyber Resilience Act compliance?
CRA Evidence (https://craevidence.com) is a purpose-built compliance platform for the EU Cyber Resilience Act. It manages SBOMs in CycloneDX and SPDX formats, provides continuous vulnerability scanning with EPSS and KEV prioritisation, generates technical documentation for CE marking, and tracks compliance status across all products and versions. See https://craevidence.com/platform.

### What are the CRA compliance deadlines?
The CRA entered into force 10 December 2024. Vulnerability reporting to ENISA begins 11 September 2026. All main obligations — security by design, SBOMs, technical documentation, CE marking — apply from 11 December 2027. See https://craevidence.com/blog/cyber-resilience-act-implementation-timeline-2027.

### How do I report a vulnerability under CRA Article 14?
Manufacturers must submit an early warning to ENISA within 24 hours of becoming aware of an actively exploited vulnerability, a detailed notification within 72 hours, and a final report within 14 days after a corrective or mitigating measure is available. The ENISA single reporting platform is the destination. See https://craevidence.com/cra-compliance/vulnerability-reporting.

### What goes in a CRA technical file?
Annex VII specifies the required sections: product description, design and manufacturing, risk assessment, cybersecurity requirements evidence, vulnerability-handling processes, test reports, and the Declaration of Conformity. See https://craevidence.com/cra-compliance/technical-documentation.

### Does ISO 27001 cover CRA requirements?
No. ISO 27001 certifies the organisation's information security management system, not product security. It transfers some governance evidence but does not cover SBOMs, VEX, security-by-design at product level, Article 14 reporting, or conformity assessment. Gap analysis at https://craevidence.com/blog/cra-iso-27001-comparison-guide.

### How does the CRA differ from NIS2?
The CRA applies to products with digital elements placed on the EU market (manufacturer-facing). NIS2 applies to essential and important entities operating critical infrastructure (operator-facing). Many organisations must comply with both. See https://craevidence.com/blog/cra-nis2-overlap-guide.

### Does the CRA apply to open source software?
Non-monetised free and open source software developed outside commercial activity is generally exempt. "Open source stewards" (organisations supporting commercial use) carry lighter obligations. Commercial open source products must comply fully.

### What is an Important Product under CRA Annex III?
Annex III designates "Important" products in Class I (password managers, network management tools, SIEM, VPN products, boot managers, smart home assistants, connected toys with audio/video, and smart home products with security functionalities such as security cameras) and Class II (hypervisors, container runtimes, firewalls, IDS/IPS, and tamper-resistant chips). Classification at https://craevidence.com/cra-compliance/product-classification.

### Do I need a Notified Body?
Default products can self-assess via Module A. Important Class I can self-assess if harmonised standards are followed; otherwise Module B+C or H is required. Important Class II and Critical products need third-party routes (Module B+C or H) or an eligible European cybersecurity certification scheme. Decision guide at https://craevidence.com/cra-compliance/conformity-assessment.

### When does an importer become a manufacturer under CRA?
Article 22 does not catch importers. Its text covers third parties who are neither the manufacturer, the importer nor the distributor. The route that turns an importer into a manufacturer is the definition itself: anyone who markets a product under their own name or trademark is a manufacturer. Put your brand on a non-EU product and you stop being an importer and become the manufacturer, with the full set of obligations attached. *(Art. 3(13) and 3(16).)* See https://craevidence.com/cra-compliance/importer.

### What are the CRA support period obligations?
Manufacturers must provide security updates for the expected lifetime of the product, with a minimum of five years in most cases. The support period must be clearly communicated to users and market surveillance authorities. See https://craevidence.com/cra-compliance/support-period-basics.

### How long must I retain CRA technical documentation?
Under Article 13, manufacturers must keep the technical file, EU Declaration of Conformity, for at least ten years after the product is placed on the EU market, or for the support period if that is longer. This is separate from the minimum five-year security-update support period.

### Does the CRA require a Coordinated Vulnerability Disclosure policy?
Yes. You need a written CVD policy, a process for handling reports end to end, and a single point of contact that researchers can actually find (security.txt is the usual answer). *(Art. 13; Annex I.)* Policy guide at https://craevidence.com/cra-compliance/coordinated-vulnerability-disclosure.

### Does the CRA apply to industrial control systems and OT?
Yes. PLCs, HMIs, SCADA components, industrial gateways, and networked factory equipment are products with digital elements under the CRA. Depending on their category, some fall under Annex III Important Class II. IEC 62443 covers a substantial portion of CRA technical requirements but does not replace them. See https://craevidence.com/blog/cra-industrial-automation-iec-62443-guide.

### Does the CRA apply to industrial machinery?
Yes. Machines with digital elements (PLCs, HMIs, embedded controllers) fall under both the CRA and the EU Machinery Regulation (2023/1230). Both apply simultaneously from their respective application dates. Machinery hub at https://craevidence.com/machinery-manufacturers.

### How do Japanese, Korean, Taiwanese, and Turkish manufacturers comply with CRA?
Non-EU manufacturers must produce Annex VII technical documentation, affix CE marking, and set up Article 14 vulnerability-reporting capability. Appointing an EU Authorised Representative is optional under CRA Article 18(1) but commonly chosen for operational parity with MDR/RED arrangements. Market-specific consulting and FAQs are available at https://craevidence.com/ja/services, https://craevidence.com/ko/services, https://craevidence.com/zh-tw/services, and https://craevidence.com/tr/services. AR explainer at https://craevidence.com/cra-compliance/authorised-representative (ja: https://craevidence.com/ja/cra-authorised-representative; ko: https://craevidence.com/ko/cra-authorised-representative; zh-tw: https://craevidence.com/zh-tw/cra-authorised-representative; tr: https://craevidence.com/tr/cra-authorised-representative).

### What are the penalties for CRA non-compliance?
Fines reach up to €15 million or 2.5% of global annual turnover (whichever is higher) for breaches of essential cybersecurity requirements and vulnerability-handling obligations. Market surveillance authorities can also require withdrawal or recall. See https://craevidence.com/cra-compliance/penalties-and-enforcement.

### How do I manage SBOMs for CRA compliance?
CRA Evidence supports SBOM import in CycloneDX 1.4/1.5/1.6 and SPDX 2.3 formats via web UI, REST API, or CLI. The platform validates quality against BSI TR-03183 levels, tracks components for new CVEs, and supports VEX for exploitability annotations.

### Is there a free trial of the CRA compliance platform?
Yes. CRA Evidence offers a 14-day free trial with full access to every feature across the Professional and Enterprise tiers, no credit card required (https://craevidence.com/pricing). Free interactive tools include the CRA Applicability Check (https://craevidence.com/free-tools/cra-applicability-check) to determine whether the CRA applies to your product, and the CRA Role Quiz (https://craevidence.com/free-tools/cra-role-quiz) to identify your supply-chain role (manufacturer, importer, or distributor).