Framework · Cyber Resilience Act (EU) 2024/2847

CRA: Your product, your file, everything in one place

The Cyber Resilience Act sets requirements for products with digital elements across the whole life cycle. Complass guides you product by product from applicability to CE marking.

Try for free Request a demo

Still from the short video “Compliance management in 20 seconds” — **Compliance management in 20 seconds** Project, next step, checklist, Statement of Applicability, audit package. Beispieldaten der Demo-Firma.

What is CRA?

The Cyber Resilience Act (CRA) is EU Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements. It requires security by design, vulnerability handling throughout the support period, reporting of actively exploited vulnerabilities and a conformity assessment with CE marking.

Content as of: 06.10.2026

Does it apply to me?

The CRA applies to products with digital elements made available on the EU market, i.e. hardware and software with a data connection such as controllers, devices and applications. Obligations mainly affect manufacturers, as well as importers and distributors. Exceptions apply, among others, to products already covered by certain other EU rules.

The reporting obligations under Art. 14 have applied since 11 September 2026, including for products placed on the market before that date.

Check for free whether CRA applies In a few minutes, no sign-up.

This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.

Legal basis

Key dates

Calculate the reporting deadlines for your case free of charge

Product compliance: CE cyber file, SBOM, CSAF and exchange with customers

How Complass helps

10phases
33guided steps
17document templates
32requirements in the catalogue

One project per product
Ten phases from applicability and role through classification and risk assessment to the declaration of conformity, post-market obligations and product liability.
Catalogue for Annex I
Essential cybersecurity requirements and vulnerability handling with status and evidence, linkable with IEC 62443-3-3 and the Machinery Regulation.
Vulnerabilities in your own product
Import the SBOM, continuously match components against public vulnerability data and create the Art. 14 incident pre-filled in case of active exploitation.
Technical documentation
Templates for, among others, risk assessment, SBOM concept, vulnerability handling process, disclosure policy, user information per Annex II and EU declaration of conformity.

See it in the tour

The phases in the module

Applicability, role and timeline
Product description, classification and conformity assessment procedure
Cybersecurity risk assessment
Essential cybersecurity requirements for the product (Annex I Part I)
Vulnerability handling, SBOM and support period (Annex I Part II)
Reporting obligations under Art. 14 (applicable since 11 September 2026)
User information and technical documentation
Conformity assessment, EU declaration of conformity and CE marking
Post-market obligations
Product liability under Directive (EU) 2024/2853

Catalogue: Annex I – Essential cybersecurity requirements

CE cyber file per product

The CRA and the Machinery Regulation in one file per product and version: requirements, SBOM, vulnerabilities, support period. Complass drafts the technical documentation and the EU declaration of conformity.

What you need at a minimum as a manufacturer

If you are a manufacturer under the CRA, this selection covers the obligations in Complass. The free applicability check shows whether it does.

minimum selection manufacturer

Start package, size S, with Vulnerabilities and attack techniques

€348 net per month

Cyber Resilience Act (CRA): Essential requirements, conformity assessment and CE marking. (Art. 13 CRA (opens in a new tab))
Vulnerabilities and attack techniques (incl. SBOM, CRA product file, MITRE ATT&CK): Handle vulnerabilities and send an early warning on actively exploited vulnerabilities within 24 hours. (Art. 14, Annex I Part II CRA (opens in a new tab))+ €149
Incident management
GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection)

Try free for 14 days Order

If you are only an importer or distributor (Art. 19, 20 CRA), the CRA framework without the vulnerability module is enough in Complass: Start, €199 net/month. Anyone who sells products under their own name or substantially modifies them counts as a manufacturer (Art. 21, 22 CRA). View selection: minimum selection importer or distributor

Recommended

Business

€739 net per month

More impact with Asset management and zones, Supplier Management and Business continuity management (BCM), room for 10 users and 2 frameworks.

Try Business

With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 6 November 2026. All packages and modules in the price overview

You can also meet the obligations without Complass. Complass supports implementation and evidence and does not replace legal advice. Legal information

Frequently asked questions

We build machines with a controller. Does the CRA or the Machinery Regulation apply?

Often both. Complass shows the overlaps and links the catalogues so that you provide evidence only once.

Does Complass submit the report to ENISA?

No. Complass calculates the deadlines and prepares the content; you submit the report via the reporting platform.

Guide Cyber Resilience Act for software makers: setting up SBOM, vulnerability handling and the 24-hour report

Try Complass with your own data

Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.