Cybersecurity risk assessment
The risk assessment is the document from which everything else follows. It sets out which security requirements apply to a product and how the manufacturer implements them. Doing it once is not enough; it has to be kept up to date.
A cybersecurity risk assessment is the documented analysis of which security risks a product poses and how the manufacturer addresses them. It is mandatory for every product and forms part of the technical documentation.
Definition in the Regulation
Article 13(2) of Regulation (EU) 2024/2847 requires manufacturers to carry out a cybersecurity risk assessment and to take it into account during planning, design, development, production, delivery and maintenance. Under Article 13(3), it is documented and updated during the support period; it takes into account the intended purpose, reasonably foreseeable use, operational environment and the length of time the product is expected to be in use, and it sets out whether and how the requirements of Annex I, Part I, point (2), are implemented. Under Article 13(4), it becomes part of the technical documentation, where any requirements that do not apply must be justified. Article 13(7) requires all relevant cybersecurity aspects to be documented systematically, including vulnerabilities the manufacturer becomes aware of, and the assessment to be updated where applicable. Annex VII, point (3) lists it as a mandatory element of the technical documentation.
What it means for manufacturers
The risk assessment is not a form but a basis for decisions: it determines whether a product needs encryption, access control or logging, for example, and it explains why something is not needed. A common mistake is a one-off assessment before the product goes on sale; Article 13(3) requires it to be kept up to date, for instance when new vulnerabilities become known or an update brings new functions. A sensible approach is one assessment per product family, reviewed with every release. Market surveillance authorities can ask for the assessment; if you cannot produce it, you cannot demonstrate conformity. The obligation applies from 11 December 2027 to products newly placed on the market.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Technical documentation
- Annex I (essential cybersecurity requirements)
- Secure by design and secure by default
- Due diligence for third-party components