Manufacturer obligations under Article 13 CRA: an overview

Article 13 of Regulation (EU) 2024/2847 brings together the obligations of manufacturers in 25 paragraphs. Broadly, they fall into four groups. First: develop securely and be able to demonstrate it (paragraphs 1 to 7, with Annex I, Part I). Second: after sale, handle vulnerabilities and provide updates (paragraphs 8 to 11 and 19, with Annex I, Part II). Third: draw up the documentation, from the technical documentation to the CE marking (paragraphs 12 to 18 and 20). Fourth: cooperate with the authorities (paragraphs 21 to 23). These obligations apply from 11 December 2027 to every product placed on the market from that date. The reporting obligation is set out separately in Article 14 and has applied since 11 September 2026.

What has applied since 11 September 2026, and what applies from 11 December 2027?

Article 71(2) splits the dates of application. Article 14 has applied since 11 September 2026. The manufacturer notifies actively exploited vulnerabilities and severe incidents within 24 hours of becoming aware of them, via ENISA's single reporting platform. The vulnerability notification follows within 72 hours, and the final report no later than 14 days after a corrective or mitigating measure is available; for an incident, the final report follows one month after the 72-hour notification (Article 14(2) and (4)). The manufacturer also informs the impacted users (Article 14(8)). This applies to legacy products too (Article 69(3)). The page The reporting obligation explained covers this in full.

All paragraphs of Article 13 apply from 11 December 2027 to products placed on the market for the first time from that date. Legacy products are only covered if they undergo a substantial modification (Article 69(2)). If you start today, you have just over a year for risk assessment, documentation and conformity assessment. The full timeline is in the guide The CRA timeline.

Article 13 paragraph by paragraph

The "From" column gives the date of application under Article 71(2); Article 14 is included for reference.

What does Annex I, Part I require of the product?

Point (1) sets out the principle: an appropriate level of cybersecurity based on the risks. Point (2) lists 13 requirements that apply "where applicable" on the basis of the risk assessment; anything that does not apply is justified (Article 13(4)).

1. (a) No known exploitable vulnerabilitiesThe product is delivered without known flaws that an attacker could use.
2. (b) Secure by default configurationSet up securely out of the box, with the option to reset it to its original state. For tailor-made products for business users, a different arrangement can be agreed.
3. (c) Fixable through security updatesVulnerabilities can be closed by updates; where appropriate, automatic updates are the default, with an opt-out and the option to postpone.
4. (d) Protection from unauthorised accessAt least authentication, identity or access management, and reporting of possible unauthorised access.
5. (e) ConfidentialityStored, transmitted or otherwise processed data is protected, for example by encryption.
6. (f) IntegrityData, commands, programs and configuration are protected against manipulation; corruption is reported.
7. (g) Data minimisationProcess only the data needed for the purpose.
8. (h) AvailabilityEssential functions remain available even after an incident, including resilience against denial-of-service attacks.
9. (i) Consideration for other devices and networksNegative effects on other systems are kept to a minimum.
10. (j) Small attack surfaceAs few ways of attack as possible, including at external interfaces.
11. (k) Limiting damageThe impact of an incident is reduced by suitable techniques.
12. (l) Logging and monitoringSecurity-relevant internal activity is recorded, with an opt-out for users.
13. (m) Secure deletion and transferUsers can permanently delete all data and settings and transfer them securely to another product.

What does Annex I, Part II require for vulnerability handling?

Part II describes the processes after sale, in eight points:

1. 1. Identify and document vulnerabilities and componentsIncluding a software bill of materials (SBOM) in a commonly used, machine-readable format, covering at least the top-level dependencies. More in the guide SBOM under the CRA.
2. 2. Remedy vulnerabilities without delayThrough security updates, separately from functionality updates where technically feasible.
3. 3. Test regularlyThe security of the product is tested regularly and effectively.
4. 4. Publish fixed vulnerabilitiesOnce an update is available: description, affected product, impact, severity, remedy. In justified cases, publication may wait until users have had the chance to patch.
5. 5. CVD policyPut in place and enforce a policy on coordinated vulnerability disclosure. See the guide Coordinated vulnerability disclosure policy.
6. 6. Facilitate information sharingIncluding a contact address through which third parties can report vulnerabilities. In Germany, BSI TR-03183-3 recommends a security.txt file for this; see the guide security.txt under RFC 9116.
7. 7. Secure distribution of updatesMechanisms that deliver updates securely and, where applicable, automatically.
8. 8. Updates without delay and free of chargeSecurity updates are distributed without delay and free of charge, with advisory messages for users. The only exception is by agreement with business users for tailor-made products.

Which documents are required?

Annex VII: technical documentation

The technical documentation is the file the manufacturer uses to show the market surveillance authorities that it meets the requirements. It is drawn up before placing on the market and kept up to date at least during the support period (Article 31(2)). Minimum content under Annex VII: a general description of the product; a description of design, development, production and vulnerability handling, including the system architecture, SBOM, CVD policy, contact address and update mechanism; the risk assessment; the information on the support period; the harmonised standards applied or, where there are none, a description of the solutions adopted; test and examination reports; a copy of the declaration of conformity. For microenterprises and small enterprises, Article 33(5) provides for a simplified form; as of October 2026 there is no evidence of an implementing act for it.

Annex V: EU declaration of conformity

By drawing up the declaration of conformity, the manufacturer takes sole responsibility for the product complying with the Regulation. Under Annex V it contains the identification of the product, the name and address of the manufacturer or authorised representative, the declaration of conformity itself, references to standards or specifications, where applicable the notified body with the certificate number, and a signature, place, date, name and function. Where a product is covered by several EU acts, such as the CRA and the Machinery Regulation, Article 28(3) requires a single declaration covering all of them.

Annex II: information and instructions to the user

The information to the user accompanies the product (Article 13(18)). Minimum content: the manufacturer with contact details; the single point of contact for vulnerability reports and where to find the CVD policy; identification, intended purpose, main functions and security properties; known circumstances that may lead to significant risks, including reasonably foreseeable misuse; the type of security support and the end date of the support period; instructions on putting into service, updates, secure decommissioning and data deletion; where the SBOM can be accessed, if the manufacturer makes it available to users.

How long do I have to keep the documents?

Article 13(13) sets two periods and applies the longer one: at least ten years after placing on the market, or until the end of the support period. The same logic applies to security updates (paragraph 9) and the information to the user (paragraph 18). If you have appointed an authorised representative, you can mandate them to keep the documents available (Article 18(3)). In addition, under Article 23 all economic operators must be able to identify, for ten years, who supplied them with products and to whom they supplied products.

What does the single point of contact in paragraph 17 mean?

Article 13(17) requires a single point of contact through which users can reach the manufacturer and report vulnerabilities, easy to find and named in the information to the user. The last sentence is decisive: the manufacturer lets users choose the means of communication and does not limit itself to automated tools. A web form does not count as an automated tool (recital 63), but on its own it is unlikely to be enough, because users must have that choice. BSI TR-03183-3 makes this concrete for Germany: security.txt under RFC 9116, e-mail and telephone as contact channels, anonymous reports and a first reply from a person within 5 working days. The guideline is voluntary, but to our knowledge it is the only guidance from a public authority that spells this out. How a small manufacturer can run the single point of contact is described in the guide PSIRT for SMEs.

Common mistakes

• Treating the risk assessment as a one-off. Paragraph 3 requires it to be updated during the support period, paragraph 7 whenever new information emerges.
• Silently leaving out requirements that do not apply. Paragraph 4 requires a justification in the documentation.
• A web form as the only point of contact. Paragraph 17 requires users to be able to choose the means of communication.
• No end date for support at the time of purchase. Paragraph 19 requires it at the time of purchase, with at least month and year.
• Postponing Article 14 to December 2027. The reporting obligation has applied since 11 September 2026 and is the only manufacturer obligation that already applies today.

Free toolsecurity.txt generatorThe contact address under Annex I, Part II, point (6) as a security.txt file following BSI TR-03183-3: fill in the fields, check the file and download it.Create the file

For this one obligation, the one with the shortest deadline, CRA Response Center keeps you ready: it monitors the security mailbox, recognises important reports at night too, alerts the people responsible and records awareness and deadlines in the history. Submission to ENISA remains with the manufacturer.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

Further reading

• Support periodHow long security updates are mandatory and how to state the end date.
• SBOM under the CRAObligation, content, format and the requirements of BSI TR-03183-2.
• Product classes and conformity assessmentWhich procedure under Article 32 applies to which product.
• Glossary: Annex IThe essential cybersecurity requirements in two sentences.

Sources

• Regulation (EU) 2024/2847, Articles 13, 14, 18, 23, 28, 31, 33, 69, 71, Annexes I, II, V, VI, VII, recital 77, EUR-Lex, accessed 7 October 2026.
• BSI TR-03183-3 Vulnerability Reports and Notifications, version 1.0.0, BSI, 20 August 2025.
• TR-03183-1 as a starting point for the CRA (in German), BSI, 5 August 2026.