Guides
What the Cyber Resilience Act actually requires, provision by provision. Written to answer the question rather than to sell you something — if a guide tells you that you are out of scope, that is the useful answer.
451 days until full application on 11 December 2027. Everything here cites the provision it comes from.
The Annex VII technical file, section by section
What each of the eight sections of the CRA technical documentation must contain, what assessors look for, and the mistakes that get files sent back.
The EU declaration of conformity: what Annex V actually requires
The eight elements Annex V prescribes for a CRA declaration of conformity, what each means in practice, and why a template alone will not save you.
CE marking for software: how it works under the CRA
How to CE mark a software product under the Cyber Resilience Act — what the marking means, where to put it when there is no physical product, and what has to exist first.
What the CRA actually requires from an SBOM
The SBOM obligation under Annex I Part II, what "commonly used and machine-readable" means, how deep it has to go, and whether you have to publish it.
Annex I Part II: the vulnerability handling requirements
The eight vulnerability handling obligations that run for the whole support period, and what evidence satisfies each one.
Article 14: the 24-hour, 72-hour and final report clocks
The CRA reporting obligations that applied from 11 September 2026 — what triggers them, who you report to, and exactly what each stage must contain.
Cyber Resilience Act deadlines: what applies when
The four dates that matter under Regulation (EU) 2024/2847, what applies at each, and which ones catch products already on the market.
Am I in scope of the Cyber Resilience Act?
Who the CRA applies to, the exclusions that actually work, and the common cases where vendors wrongly believe they are outside it.
Start with your own product
The guides are general. The scope checker gives you an answer about your product specifically — your role, your Annex III classification, and whether you can self-assess — as a PDF with your product named on it.