CRA Readiness and Cybersecurity Compliance

A modern product may combine hardware, firmware, embedded software, mobile applications, cloud functions, APIs, open-source libraries and third-party components. Before detailed compliance work begins, the manufacturer must define which elements form the regulated product and whether connected remote data-processing solutions are part of its product boundary.

Classification is equally important. Products may fall within the default category or be classified as important or critical products. This classification influences the applicable conformity assessment procedure. Most default-category products can follow manufacturer self-assessment, while important and critical product categories may require stricter procedures or the involvement of a notified body.

A structured CRA readiness assessment helps prevent businesses from:

• Assessing the wrong product scope
• Selecting an unsuitable conformity route
• Overlooking connected software or cloud components
• Collecting evidence that does not address CRA requirements
• Discovering major cybersecurity gaps close to product launch
• Treating CRA compliance as an isolated cybersecurity project

 

1. Build a Product and Software Inventory

Create a reliable list of products intended for the EU market. Record product versions, firmware, software modules, connected services, update mechanisms and third-party dependencies.

Where several product variants use the same architecture, document which cybersecurity controls and software components are shared. Do not automatically assume that one assessment covers every version or configuration.

2. Confirm CRA Scope Before Detailed Testing

Document why each product is in scope, outside scope or potentially covered by another relevant sector-specific framework.

Confirm whether the organisation acts as the manufacturer, importer, distributor or authorised representative for each route to market. Economic-operator roles can affect the responsibilities that need to be included in the compliance plan.

The European Commission published detailed practical CRA guidance on 27 July 2026, covering issues such as product scope, remote data-processing solutions, substantial modifications, support periods, reporting and cybersecurity risk assessments. Scope decisions should be reviewed against this guidance and the binding legal text.

3. Define the Complete Digital Product Boundary

Do not assess only the physical device or main software application. Include the digital elements that support the product’s intended functions, where relevant, such as:

• Firmware and embedded operating systems
• Mobile applications
• Customer or administrator portals
• Cloud backends and remote services
• APIs and communication interfaces
• Update and patching mechanisms
• Open-source and third-party software
• Authentication and account-management services

A clear product boundary supports accurate risk assessment, cybersecurity testing, technical documentation and conformity planning.

4. Classify the Product and Plan the Conformity Route

Determine whether the product belongs to the default category or an important or critical category.

Record the classification reasoning, relevant product functionality, applicable legal descriptions and any standards or certification schemes that could support conformity. Where third-party assessment may be required, identify this early to reduce the risk of delays close to market launch.

5. Perform a Risk-Based Cybersecurity Gap Assessment

Review the product and its development processes against relevant cybersecurity expectations, including:

• Secure-by-design and secure-by-default controls
• Authentication and access management
• Protection of confidentiality and integrity
• Product availability and operational resilience
• Attack-surface reduction
• Secure update mechanisms
• Security logging and monitoring
• Vulnerability identification and remediation
• Software supply-chain controls
• Security information provided to users

Each finding should be linked to the affected product, supporting evidence, cybersecurity risk, compliance impact, remediation owner and target completion date.

6. Prepare Compliance Evidence as Work Is Completed

Do not leave technical documentation until the end of the project. Build and maintain an organised evidence set throughout product development and remediation.

Depending on the product, evidence may include:

• Cybersecurity risk assessments
• Architecture and data-flow information
• Security requirements and design decisions
• Threat models
• Software-component and dependency information
• Verification and cybersecurity test results
• Vulnerability and remediation records
• Secure update documentation
• Product security instructions
• Support-period decisions
• Supplier cybersecurity evidence

Evidence should be version-controlled, reviewable and traceable to the applicable product release.

7. Establish Vulnerability and Incident Reporting Readiness

Manufacturers need processes to receive, assess, remediate and disclose vulnerabilities throughout the product’s stated support period.

Reporting procedures should define decision owners, technical escalation routes, legal and regulatory responsibilities, required information sources and access to the EU Single Reporting Platform.

For reportable actively exploited vulnerabilities and severe incidents, the CRA framework requires an early warning within 24 hours of awareness and a full notification within 72 hours. Further final-report requirements depend on whether the event concerns an actively exploited vulnerability or a severe incident.

8. Turn the Findings into a Managed Roadmap

Prioritise actions according to:

• Cybersecurity risk
• Regulatory importance
• Product launch date
• Conformity assessment route
• Engineering complexity
• Supplier dependency
• Evidence availability

Separate immediate readiness actions from longer-term product or development-process changes.

Every roadmap action should have an accountable owner, defined completion evidence, a realistic due date and a closure review. The roadmap should also be reassessed when product architecture, intended use, software components, suppliers or regulatory guidance change.

A CRA readiness engagement may produce:

The exact deliverables should reflect the product type, portfolio size, development maturity and intended EU market timeline.

This service is designed for manufacturers and software producers developing or placing products with digital elements on the EU market.

It is particularly relevant for organisations that need to:

• Determine whether the CRA applies to their products
• Classify a product or wider product portfolio
• Understand the likely conformity assessment route
• Evaluate existing cybersecurity controls
• Prepare CRA technical documentation
• Review vulnerability-handling processes
• Coordinate regulatory and engineering teams
• Build a phased cybersecurity compliance roadmap

Starting early gives organisations more time to incorporate cybersecurity requirements into product development rather than treating compliance as a late-stage documentation exercise.

ComplyMarket combines product compliance knowledge, regulatory interpretation, cybersecurity assessment and technical documentation support. A CRA engagement can begin with a focused assessment of one product or be structured across a wider product portfolio.

ComplyMarket can support your organisation by:

• Reviewing CRA applicability and regulatory scope
• Defining the product and assessment boundary
• Supporting product classification
• Mapping relevant cybersecurity requirements
• Identifying product and process gaps
• Prioritising remediation activities
• Planning technical evidence and documentation
• Reviewing vulnerability-handling readiness
• Developing a practical CRA compliance roadmap
• Coordinating compliance, product and technical stakeholders

ComplyMarket publicly describes its CRA support as covering regulatory scoping, product classification, cybersecurity gap assessment, technical documentation and preparation for conformity assessment.

Where deeper technical assurance is required, the ComplyMarket Cybersecurity Lab can support product-focused assessments and testing for software, firmware, embedded systems, web applications, APIs, mobile applications, IoT devices and connected products. This can help convert readiness findings into technical evidence and verified remediation activities.

ComplyMarket provides readiness, assessment, testing and documentation support. Formal conformity assessment or certification, where required by the CRA, must be completed through the applicable authorised route, including an authorised notified body where necessary.

A structured CRA readiness assessment provides clarity before significant resources are committed to testing, documentation or product redesign.

Contact ComplyMarket to establish your regulatory position, identify priority cybersecurity gaps and build a practical, evidence-led roadmap for products with digital elements.