Vigilon CRA Readiness & Technical Documentation
Identify gaps against the EU Cyber Resilience Act (CRA), plan the work, and assemble the evidence and technical documentation — sometimes called a technical dossier — that the CRA requires.
Reporting obligations already apply
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products through the EU Single Reporting Platform — including for products already on the market. Check your reporting readiness.
What is the Cyber Resilience Act?
The Cyber Resilience Act (CRA) — Regulation (EU) 2024/2847 — is the EU’s horizontal cybersecurity regulation for products with digital elements. It sets cybersecurity requirements for the design, development and production of those products, and for how manufacturers handle vulnerabilities while the products are in use.
It covers hardware and software products, including their remote data processing solutions, that are made available on the EU market and can connect to a device or network. Some products are excluded, such as those covered by the EU medical device and vehicle type-approval regulations. It sets obligations for manufacturers, importers and distributors.
Key dates
- 10 December 2024: the CRA entered into force.
- 11 June 2026: provisions on conformity assessment bodies apply.
- 11 September 2026: manufacturers’ reporting obligations apply.
- 11 December 2027: the remaining provisions apply.
What manufacturers need to do
Security by design
- Assess and document the product’s cybersecurity risks, and use that assessment through planning, design, development, production, delivery and maintenance.
- Meet the essential cybersecurity requirements in Annex I — for example, making the product available without known exploitable vulnerabilities and with a secure-by-default configuration.
Vulnerability handling
- Put in place and enforce a coordinated vulnerability disclosure policy, and provide a contact address for reporting vulnerabilities.
- Draw up a software bill of materials (SBOM) in a commonly used, machine-readable format, covering at least the product’s top-level dependencies.
- Provide security updates without delay and free of charge during the support period, which is at least five years unless the product is expected to be in use for less time.
Reporting
- For an actively exploited vulnerability: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within 14 days of a corrective or mitigating measure being available.
- For a severe incident: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month of the notification.
- Notifications go through the Single Reporting Platform to the CSIRT of the Member State of your main EU establishment, and are accessible to ENISA at the same time.
Conformity assessment
- Most products: internal control (module A) is available.
- Important products, class I: internal control only where harmonised standards, common specifications or a European cybersecurity certification scheme are fully applied; otherwise third-party assessment.
- Important products, class II: third-party assessment, or a European cybersecurity certification scheme where available.
- Critical products: a European cybersecurity certificate where required by delegated act; otherwise the class II procedures.
Our CRA services
CRA gap analysis
We assess your current product security and development processes against the essential requirements in Annex I of the CRA. You receive a prioritised plan for the work.
Technical documentation
We help you assemble the technical documentation the CRA requires — the product description, design and vulnerability handling information, the cybersecurity risk assessment, the basis for the support period, the standards applied and test reports — and keep it ready for market surveillance authorities.
Vulnerability handling and reporting process design
We help you design and implement vulnerability handling procedures, including coordinated disclosure, incident response and the notification workflow for the Single Reporting Platform.
SBOM management
We help establish SBOM generation, maintenance and distribution processes that meet CRA documentation requirements and support supply-chain risk management.
Conformity assessment preparation
Whether your product is a default, class I, class II or critical product, we prepare you for the conformity assessment route that applies, including Notified Body examination where required.
Conformity assessment
Document and SDLC review and hands-on penetration testing that produces test reports that feed evidence in your technical documentation.
Ongoing reporting with Vigilon Continuum
Vigilon Continuum is our SaaS reporting platform. It is separate from the EU’s official Single Reporting Platform. About Vigilon Continuum.
See also our RED cybersecurity testing for radio products, and our risk assessment services for the cybersecurity risk assessment the CRA requires.
Sources: Regulation (EU) 2024/2847, Articles 2, 13, 14, 32 and 71 and Annexes I and VII; European Commission, “Cyber Resilience Act: reporting obligations” (updated 11 September 2026). Checked 13 September 2026.