CRA guides for embedded product manufacturers
We explain, topic by topic, what the EU Cyber Resilience Act (CRA) requires from teams building embedded and connected products. Each guide cites the articles it relies on and the official sources.
CRA guide: overview
Scope, timeline, Annex I essential requirements, product classes, reporting and fines on one page.
CRA Article 14: vulnerability and incident reporting
When, to whom and how fast to report. 24 hours, 72 hours and the final report, with a free deadline calculator.
CRA product classes, conformity assessment and CE marking
Default, important (Class I and II) and critical products; which module applies and when you need a notified body.
EN 18031 and RED: how they relate to the CRA
Cybersecurity requirements for radio equipment in force since 1 August 2025, and the move to the CRA.
CRA readiness guide
For every manufacturer selling into the EU: roles, timeline, extra points for non-EU manufacturers and a step-by-step checklist.
What is an SBOM? The CRA's SBOM requirement
Software bill of materials, CycloneDX and SPDX, SBOMs for Yocto and Buildroot, with a free scanner.
CRA and embedded security glossary
Short definitions of SBOM, VEX, CSAF, KEV, EPSS, notified body, support period and more.