The CRA Compliance Guide

Start by checking Annex III, which lists Class I (Important) and Class II (Critical) categories. If your product is on neither list, it is a default product.

Default products self-assess. Class I needs a notified body unless fully harmonised standards are applied. Class II always requires a notified body.

Document the classification decision and the reasoning. Market-surveillance authorities will ask.

Build a simple matrix: requirement on one axis, your evidence on the other. For each cell, capture the control, the test that proves it, and any gap.

Common gaps for software: missing SBOM, no documented vulnerability disclosure policy, weak update mechanisms, no security-by-default flags.

Common gaps for hardware: factory-reset paths, secure-boot enforcement, signed firmware updates, attack-surface minimisation.

Generate the SBOM in your CI pipeline and treat it like an artefact: stored, versioned, signed, and reproducible.

Tools: Syft for containers, cyclonedx-bom for Python, cyclonedx-npm for Node, cyclonedx-gradle-plugin for JVM. The output format does not need to be exposed publicly — it must be available to authorities on request.

Keep the SBOM linked to the build that produced it. When a vulnerability is reported in a dependency, you need to find every shipped version that contained it within hours.

Publish a /.well-known/security.txt file pointing at a triage email or form, plus a public PGP key if you want encrypted reports.

Define internal SLAs: time-to-acknowledge, time-to-triage, time-to-fix, time-to-disclose. Make them realistic — and stick to them.

Wire up your build/release pipeline so a security update can ship without a multi-week regression cycle. The CRA expects "without undue delay".

The DoC follows the template in Annex V. Required fields: product description, manufacturer details, statement of compliance with Regulation 2024/2847, conformity assessment procedure used, and any harmonised standards applied.

For default products, the DoC can be drafted internally. For Class II it must reference the notified body number.

Make the DoC machine-readable and link it from the product page. Many manufacturers publish it as a PDF inside a versioned /legal/cra-doc-vX.pdf URL.

For physical products, CE marking goes on the product itself or its packaging.

For software, the CE marking and DoC reference must appear in the user-facing documentation, app-store listing, or the about screen.

Once CE is applied, you have legally declared conformity. Misrepresentation is one of the higher-tier fines.

Register your manufacturer profile on the ENISA Single Reporting Platform ahead of 11 September 2026. Don't wait for an incident.

Decide who is on the rotation, who has authority to submit, and what your internal cut-off line is for "actively exploited" — this is the trigger for the 24h clock.

Practice the workflow in a tabletop exercise. The first time you submit should not be in production.