EU Cyber Resilience Act Compliance Roadmap: What Product Companies Must Do Before 2027

The CRA Enforcement Timeline You Need to Know

The CRA's phased enforcement timeline creates different urgency levels for different obligations. Understanding which deadlines apply to which requirements is the starting point for any CRA roadmap.

Step 1: Classify Your Products

The single most consequential decision in CRA compliance is product classification. The CRA creates four categories with different conformity assessment pathways:

Default Category (Self-Assessment)

The vast majority of products with digital elements — software applications, connected devices, and general-purpose hardware — fall into the default category. Manufacturers can perform their own conformity assessment and affix the CE mark without involving a notified body (third-party auditor). This is the lowest compliance burden but still requires full documentation of compliance with the CRA's essential requirements, including SBOM, vulnerability management, and secure development.

Important Products — Class I

Products with a significant cybersecurity risk profile due to functionality, use cases, or the sectors they serve. Class I examples include: identity management systems, password managers, network monitoring tools, VPNs, browser extensions, routers for home use, and microcontrollers in consumer devices.

Class I manufacturers can still self-assess but must follow harmonized European standards (ENs) or apply for ENISA certification. Third-party assessment is required only if manufacturers choose not to follow the harmonized standards.

Important Products — Class II

Higher-risk products in more sensitive categories: operating systems, hypervisors, industrial control systems, firewalls, intrusion detection/prevention systems, and hardware security modules. Class II products require mandatory third-party conformity assessment by an EU-recognized notified body.

Critical Products

A small set of products designated by the European Commission based on their role in critical infrastructure: smart meter gateways, hardware security modules used in critical infrastructure, and systems specifically listed in Annex III of the CRA. Critical products require certification under a European cybersecurity certification scheme.

Step 2: Understand the Essential Requirements

Annex I of the CRA defines the essential cybersecurity requirements that all products in scope must meet. These fall into two categories:

Security Properties of the Product

• No known exploitable vulnerabilities at the time of placing on the market
• Secure by default configuration — security features enabled out of the box
• Protection against unauthorized access (authentication, access control)
• Protection of data in storage and transit (encryption where appropriate)
• Limited attack surface — only necessary ports, services, and interfaces enabled
• Availability protections against denial-of-service attacks
• Ability to receive security updates for the product's expected lifetime

Vulnerability Handling Requirements

• Identify and document components (SBOM — the explicit requirement)
• Timely remediation and disclosure of vulnerabilities
• Security updates available for a minimum of 5 years (or the expected product lifetime, if shorter)
• A coordinated vulnerability disclosure policy
• Mechanisms to securely distribute security updates

Step 3: Build Your SBOM Program for CRA Compliance

Article 13(3) of the CRA explicitly requires manufacturers to "identify and document components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format." This is one of the clearest and most operationally specific requirements in the regulation.

The CRA does not mandate a specific SBOM format, but "commonly used and machine-readable" effectively means SPDX or CycloneDX. Both formats are recognized by ENISA and align with NTIA minimum elements, making them appropriate for organizations that also need to satisfy U.S. federal requirements.

Minimum SBOM Content for CRA Compliance

• Component name and version for every direct and transitive dependency
• Supplier name where known
• Unique identifier (PURL or CPE)
• License information for each component
• Known vulnerabilities (or a linked VEX document)
• Timestamp of SBOM generation and SBOM version

The CRA requires the SBOM to be maintained and updated throughout the product lifecycle, not just generated at initial release. This directly addresses the SBOM drift problem: a product shipped into the EU market must have an SBOM that reflects its current state.

Step 4: Implement Vulnerability Reporting (Before September 2026)

This is the deadline that many organizations are underestimating. From September 2026, CRA-scoped manufacturers must:

• Report actively exploited vulnerabilities in their products to ENISA within 24 hours of becoming aware
• Provide a detailed vulnerability report within 72 hours
• Provide a final report within 14 days including root cause, remediation, and impact assessment
• Notify affected users of the vulnerability and the available remediation

The 24-hour initial notification requirement is operationally aggressive. It means manufacturers need a documented vulnerability triage process that can assess severity, confirm exploitation, and generate a compliant report to ENISA in under a day. Most organizations do not currently have this capability.

Step 5: Prepare Technical Documentation

The CRA requires manufacturers to draw up technical documentation before placing a product on the EU market. This documentation must be available to market surveillance authorities on request and must include:

• General product description including intended use and user types
• Design and development documentation, including architecture diagrams
• Risk assessment against the CRA essential requirements
• The SBOM (or reference to where it is maintained)
• EU declaration of conformity
• Vulnerability handling policy and coordinated disclosure process
• For Class I and II: details of conformity assessment procedure followed

Technical documentation must be retained for 10 years after the product is placed on the market.

Step 6: Understand Open Source Scope

The CRA includes a specific carve-out for open source software: software developed entirely in the open, made available free of charge, and not placed on the market in the course of a commercial activity is generally exempt. However, this exemption has significant limits:

• A company that commercially supports, integrates, or distributes an open source component as part of a product is not exempt for that product
• Open source components integrated into a commercial product are covered by the manufacturer's CRA obligations for that product
• The "Steward" role — a company that provides commercial support for an open source project without distributing it — carries a lighter obligation set but is explicitly within CRA scope

For practical purposes: if your product ships with open source dependencies (almost all products do), those dependencies are within the scope of your CRA SBOM obligation. The open source carve-out does not exempt your product; it may exempt the upstream maintainer.

The 2026 Compliance Checklist

For organizations that need to structure their CRA work for the remainder of 2026, here is a practical milestone plan:

• Q2 2026 — Complete product portfolio classification against CRA Annex II. Identify Class I and Class II products. Begin notified body procurement if required.
• Q2 2026 — Implement SBOM generation in build pipelines for all CRA-scoped products. Target SPDX 2.3 or CycloneDX 1.5.
• Q2 2026 — Register for ENISA Single Reporting Platform and complete test submissions.
• Q3 2026 (before September) — Vulnerability triage and reporting process documented, tested, and operational. Target ≤20 hours from detection to initial ENISA notification.
• Q3 2026 — Technical documentation drafted for top-priority products. Vulnerability disclosure policy published.
• Q4 2026 — Complete technical documentation for all remaining scoped products. Begin conformity assessment for Class I products.
• H1 2027 — Complete notified body assessments for Class II products. Finalize EU declarations of conformity.