Annex I (essential cybersecurity requirements)
Annex I is the core of the Regulation. Every declaration of conformity, every assessment by a notified body and most of the fines refer back to this catalogue.
Annex I is the part of Regulation (EU) 2024/2847 that lists the essential cybersecurity requirements for products with digital elements: Part I covers the properties of the product, Part II the handling of vulnerabilities.
Definition in the Regulation
Article 13(1) requires manufacturers to design, develop and produce their products in accordance with Annex I, Part I. Point (1) of Part I requires an appropriate level of cybersecurity. Point (2) lists thirteen requirements that apply on the basis of the risk assessment and "where applicable". They include making the product available on the market without known exploitable vulnerabilities, a secure by default configuration, protection from unauthorised access, encryption, data minimisation, a limited attack surface, logging and secure deletion of data.
Part II sets out vulnerability handling in eight points. Manufacturers document components, including a software bill of materials (SBOM), remediate vulnerabilities without delay, test security regularly and publish information about fixed vulnerabilities. They also put in place a policy on coordinated vulnerability disclosure (point (5)), provide a contact address for reporting vulnerabilities (point (6)), distribute updates securely and provide security updates free of charge. Under Article 13(8), these obligations apply throughout the support period.
What it means for manufacturers
Annex I applies from 11 December 2027 to every product placed on the market from that date. Which requirements of Part I apply is decided by the documented risk assessment; under Article 13(4), any that do not apply must be justified in the technical documentation. As no harmonised standard has been published in the Official Journal as of October 2026, manufacturers have to describe their own solutions. Under Article 64, infringements of Annex I fall within the highest band of fines.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Secure by design and secure by default
- Cybersecurity risk assessment
- Software bill of materials (SBOM)
- Coordinated vulnerability disclosure (CVD)
- Presumption of conformity