Guides to the Cyber Resilience Act
Guides written for senior management and for the people who put the CRA into practice in their organisation. Each one names the articles of the Regulation it relies on, and its sources.
Legal status as of 8 October 2026. Not legal advice. Changes are covered under News; the Glossary explains the terms.
The reporting obligation explainedIn force since 11 September 2026: 24 hours, 72 hours, 14 days. With a deadline calculator.Read
CRA Applicability CheckNine questions, three minutes: is your product covered by the Regulation, and which class is it likely to be in?Start the check
security.txt generatorCreate your reporting address in line with RFC 9116 and BSI TR-03183-3, with every field explained, a check of the finished file and a draft CVD policy.Create the file
GlossaryThe terms of the Regulation in brief, from actively exploited vulnerability to substantial modification.Go to the glossary
Reporting obligation
- ENISA Single Reporting Platform: registration and notification step by stepCreate an account, choose the CSIRT, set up cover, complete all three notification stages. With a field table.
- When does the 24-hour deadline start? Awareness under Article 14 CRAAwareness means an initial assessment with a reasonable degree of certainty, not receiving or reading the e-mail. With a weekend example.
- Actively exploited vulnerability: what must be reported and what need not beThe definition in Article 3, point (42), what is not a trigger, third-party components, a decision tree.
- Severe incident under the CRA: where the line is drawn, with examplesArticle 14(3) and (5) explained, the difference from a vulnerability, deadlines, examples, NIS2.
- Early warning, notification, final report: what goes into each of the three stagesContent and deadline of each stage for vulnerabilities and incidents, with the platform's field list and examples.
- CERT-Bund, BSI, ENISA: who receives CRA notificationsThe roles of ENISA, the coordinating CSIRT, CERT-Bund and the BSI in receiving a notification under Article 14.
- Informing users under Article 14(8): what manufacturers must tell themWho, when, in what form; Commission guidance; updates and support period; model outline.
- The first 24 hours after a vulnerability report: a runbook for manufacturersAn hour-by-hour plan from intake to early warning, with roles, common mistakes and a weekend scenario.
Reporting address and process
- security.txt under RFC 9116 and BSI TR-03183-3: a guide for manufacturersMandatory fields, the psirt@ and csirt@ roles, the signature, checks and the most common errors, with an example file.
- Coordinated vulnerability disclosure policy (CVD policy): what it must containLegal basis, minimum content under TR-03183-3, a twelve-point outline and the common mistakes.
- PSIRT for SMEs: receiving, assessing and answering vulnerability reportsRoles under TR-03183-3, the process from receipt to security advisory, and the minimum set-up.
- Spam in the security mailbox: handling beg bounties, scanner reports and bulk mailWhat arrives in the security mailbox, why nothing may be silently deleted, and how policy, classification and replies fit together.
- Outsourcing the CRA reporting obligation: what a service provider can and cannot take onWhat can legally be outsourced, what stays with the manufacturer and how to recognise a service worth using.
Basics
- The Cyber Resilience Act timeline: what applies whenEvery key date from 2024 to 2030, what already applies today and what counts for legacy products.
- Who is the manufacturer under the CRA? Agency, client, own brand, importerWho carries the manufacturer's obligations, who is only an importer or distributor, and when the role changes.
- Manufacturer obligations under Article 13 CRA: an overviewArticle 13 paragraph by paragraph, Annex I as a list, record keeping, single point of contact, and what applies when.
- Product classes and conformity assessment: default, important, criticalWhich products are important or critical, which procedure applies to each class, and what missing standards mean.
- Fines and market surveillance under the CRA: amounts, authorities, procedureThree tiers of fines up to EUR 15 million, applicable from 11 December 2027, and what market surveillance can do from then on.
- The German CRA implementation act: status, content and the role of the BSIWhere the bill stands, what it contains, what industry associations criticise and what already applies without it.
- The CRA in Austria and Switzerland: responsibilities, status, exports to the EUCERT.at as coordinator, Federal Chancellery, NISG 2026; Swiss exporters, authorised representative, Federal Council.
Manufacturer obligations
- SBOM under the CRA: obligation, content, format and BSI TR-03183-2What the Regulation requires of the software bill of materials, what the BSI recommends and who may see it.
- Support period: how long security updates are requiredAt least five years, measured against expected use. End date, free updates, older versions, machinery.
- Substantial modification: when an update makes a new productSecurity fix: no. New feature: often yes. Consequences, examples and a checklist for every release.
Roles and scope
- Importers, distributors and authorised representatives: obligations under Articles 18 to 22 CRAChecklists for each role, passing vulnerabilities on to the manufacturer, change of role for own brands.
- CRA and NIS2 compared: product or entity, two reporting obligationsComparison table, being covered by both with an example, why neither notification replaces the other, neighbouring rules.
- Open source and the CRA: stewards, commercial use, reporting obligationsCommercial activity as the dividing line, stewards with light-touch obligations from December 2027, due diligence for components.
- SaaS, cloud and remote data processing: when an online service is part of the productThree criteria, examples from the guidance, a table of what is and is not part of the product, reporting obligation.
- The CRA in machinery and plant engineering: what manufacturers need to prepare forThe machine as a product with digital elements, bought-in controllers, the Machinery Regulation, machines already in the field.
- The CRA for agencies and custom software: who is the manufacturer and who is notCommissioned work, own plugin, website, open source: when the agency or the client is the manufacturer.
The reporting obligation already applies. Who answers at night at your company?
CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.