01Who is covered?
If your product can connect directly or indirectly to a device or a network and is sold on the EU market, you are in scope: smart home products, industrial controllers, network equipment, sensors, wearables and the software sold with them. Products with their own rules, such as medical devices, motor vehicles, civil aviation and marine equipment, are excluded (scope).
What matters is placing the product on the EU market, not where the manufacturer is. A manufacturer in Germany, Türkiye, the UK, the US or Asia has the same obligations.
If you place the product on the market under your own name or trademark, you are the manufacturer. If you produce for another brand (OEM/ODM) and the product is sold under that brand's name, the CRA manufacturer is usually the brand; it will still ask you for the SBOM, vulnerability fixes and security updates.
02Manufacturer, importer and distributor
| Role | Main obligations | Basis |
|---|---|---|
| Manufacturer | Annex I requirements, risk assessment, vulnerability handling, support period, technical documentation, EU declaration of conformity, CE marking, Article 14 reporting, informing users | Articles 13, 14 |
| Authorised representative (optional) | Carries out specified tasks under the manufacturer's written mandate; keeps the declaration of conformity and technical documentation available to authorities | Article 18 |
| Importer | Brings a non-EU manufacturer's product into the EU. Places only compliant products on the market: checks that conformity assessment was done, technical documentation exists, CE marking and user information are present; informs the manufacturer of vulnerabilities it learns about | Article 19 |
| Distributor | Checks the CE marking and required information; acts when it finds non-conformity or a significant risk | Article 20 |
03Extra points for manufacturers outside the EU
- Your importer has to check you. An EU importer cannot place a non-compliant product on the market, so importers have started asking for technical documentation, declarations of conformity and commitments on security updates.
- An authorised representative is optional. Appointing one is not mandatory under the CRA (Article 18), but it can make things easier.
- Article 14 reporting is your responsibility. Without a main establishment in the EU, the coordinating CSIRT is determined by where your authorised representative, importer or distributor is established (Article 14). See the Article 14 guide.
- Follow your home country's rules as well. Whether and when countries outside the EU adopt similar rules varies; for sales into the EU, the EU rule is what counts.
04Timeline: what has started and what is coming
- Since 11 September 2026: Article 14 reporting of actively exploited vulnerabilities and severe incidents. It applies today to your products sold in the EU.
- Since 11 June 2026: provisions on notified bodies.
- From 11 December 2027: all obligations, including Annex I essential requirements, conformity assessment and CE marking. Products placed on the market after that date must fully comply.
05Step-by-step checklist
- Product inventory: list the connected products and firmware versions you sell in the EU.
- Scope and class: determine each product's category (product classes).
- SBOM: produce a machine-readable SBOM for each firmware version (free SBOM scanner).
- Vulnerability handling: check components continuously against new vulnerabilities, prioritise the exploited ones and distribute fixes free of charge.
- Coordinated disclosure policy and point of contact: publish one contact address for vulnerability reports (Article 13); security.txt is a good start.
- Article 14 process: the moment of becoming aware, owners, ENISA SRP access and report templates.
- Secure updates: signed updates, rollback protection, safe return on a failed update.
- Support period: set a support period per product and state it at the point of sale.
- Technical documentation and declaration of conformity: the Annex VII content including the risk assessment; keep it for 10 years or the support period.
- Supply chain contracts: write down with suppliers, importers and distributors how vulnerability information flows and who keeps what.
06Frequently asked questions
I manufacture outside the EU and sell into the EU. Does the CRA apply to me?
Yes. The CRA looks at whether the product is placed on the EU market, not where the manufacturer is.
I am an EU-based manufacturer. Does this checklist apply to me?
Yes. The checklist is the same for every manufacturer; only the section for manufacturers outside the EU does not apply to you.
Do I have to appoint an authorised representative in the EU?
Appointing one is optional under the CRA (Article 18). Having a representative, importer or distributor in the EU does affect which CSIRT coordinates your Article 14 reports.
I am a contract manufacturer. Who is responsible?
If the product is sold under another brand's name, the CRA manufacturer is usually that brand. It will still rely on you for the SBOM, vulnerability fixes and updates, so put these obligations in the contract.
Can I wait until 11 December 2027?
No. Article 14 reporting has applied to all your products in the EU since 11 September 2026, and the Annex I requirements affect product design, so preparation needs to start now.
Sources
Related guides
- CRA Article 14: vulnerability and incident reportingWhen, to whom and how fast to report. 24 hours, 72 hours and the final report, with a free deadline calculator.
- CRA product classes, conformity assessment and CE markingDefault, important (Class I and II) and critical products; which module applies and when you need a notified body.
- EN 18031 and RED: how they relate to the CRACybersecurity requirements for radio equipment in force since 1 August 2025, and the move to the CRA.
- CRA guide: overviewScope, timeline, Annex I essential requirements, product classes, reporting and fines on one page.
Let's talk about this process for your product
Our enterprise pilot generates the SBOM of your firmware, prioritises vulnerabilities and tracks Article 14 deadlines.