Cyber Resilience Act checklist
CRA checklist for Annex I, Art. 13 and Art. 14
Annex I parts I and II plus the manufacturer and reporting duties of Art. 13 and 14, as a list to assess per product version.
What the file contains
32 requirements, one row each with area, reference and what an audit wants to see as evidence. You fill in the columns for status, evidence, owner and due date.
- Annex I – Essential cybersecurity requirements 22 rows
- Obligations of manufacturers and reporting obligations (Art. 13 and 14) 10 rows
Template version 1.0-3d9492d0 · content as of 12 November 2026 · Excel (XLSX) 105 KB · PDF 42 KB
This template exists in German and English; you get the English version.
This template is not legal advice. It does not replace checking which requirements apply to your company and does not guarantee any audit or certification result. License CC BY 4.0
How to use the file
Settle what applies
Assess per product and product version. Justify requirements that do not apply in the risk assessment.
Enter status and evidence
For each row a status (open, partly, met, not applicable) and where the evidence is.
Assign the gaps
Open rows get an owner and a due date. That turns the list into a plan.
The portal takes it from there
In Complass you assess the same requirements in the CE cyber file per product version, with SBOM, vulnerabilities and the reports under Art. 14.
- Przewodnik Cyber Resilience Act for software makers: setting up SBOM, vulnerability handling and the 24-hour report
- Przewodnik Does the CRA apply to me? Checking products with digital elements
- Przewodnik CRA reporting duty for manufacturers: what Art. 14 requires and how to report
- Przewodnik Technical documentation under the CRA: content and upkeep
- Przewodnik CRA and IEC 62443: where they overlap and what is missing
Przetestuj Complass na własnych danych
Mogą Państwo samodzielnie założyć konto testowe, na życzenie z przykładowym projektem dla każdej regulacji. Jeśli wolą Państwo najpierw zobaczyć Complass, proszę umówić demo.