normakte  /  CRA checklist

CRA checklist: 14 points

Fourteen points in the order they come up in a company. Print it or use it as a guide for implementation.

Classify

  • Checked that the product is a product with digital elements and no exclusion applies
  • Category determined: default, important (class I or II) or critical
  • Conformity assessment procedure chosen; notified body contacted if needed
  • Reporting channel via ENISA's platform set up (applies since 11.09.2026)

Develop

  • Cybersecurity risk assessment documented
  • Essential requirements of Annex I Part I implemented, including secure default settings
  • Components recorded in an SBOM
  • Support period set and justified

Operate

  • Coordinated disclosure policy and vulnerability contact point published
  • Security updates free of charge, separate and automatic where possible
  • Fixed vulnerabilities are published

Declare

  • Technical documentation under Annex VII complete
  • User information under Annex II, including the end of the support period
  • EU declaration of conformity and CE marking from 11.12.2027

The CRA file for your product

Register with all CRA requirements, classification, SBOM, reports with deadlines, support period and a target page for user information – one trial file free until 20.01.2027.

Create a trial fileCalculate reporting deadlines

Read next

CRA risk assessmentCRADisclosure policy templateCRACRA compliance softwarenormakteCRA classificationCRACRA declaration generatorCRASBOM under the CRACRACRA for digital productsCRAImportant and critical productsCRAVulnerability handlingCRA

Source. Regulation (EU) 2024/2847, OJ L, 2024/2847 of 20.11.2024. Summarised; only the official text is authoritative. normakte is not legal advice.