Cyber Resilience Act Requirements: The Annex I Checklist for Manufacturers

The deadlines

Date	What applies	Article
11 June 2026	Rules on conformity assessment bodies (Chapter IV)	71(2)
11 September 2026	Reporting of actively exploited vulnerabilities and severe incidents, also for products already on the market	71(2), 69(3)
11 December 2027	Everything else, including the essential requirements in Annex I	71(2)

Products placed on the market before 11 December 2027 only need to meet the requirements if they are substantially modified after that date (Article 69(2)); the reporting duties apply to them regardless. Our CRA reporting guide covers the duties that already apply.

Your duties as manufacturer (Article 13)

Risk assessment: assess the product's cybersecurity risks and take the result into account in planning, design, development, production, delivery and maintenance (Article 13(2)). Document it, update it during the support period, and record which Annex I requirements apply and how you meet them (Article 13(3)).
Third-party components: exercise due diligence so that components, including open-source ones, do not compromise the product (Article 13(5)). Report vulnerabilities you find in a component to whoever maintains it (Article 13(6)).
Support period: set it to reflect how long the product is expected to be in use, and at least five years unless the product is expected to be used for less (Article 13(8)). State its end date, at least month and year, at the time of purchase (Article 13(19)).
Updates stay available: each security update issued during the support period must remain available for at least 10 years after it is issued, or for the rest of the support period if longer (Article 13(9)).
Documentation and conformity: draw up the technical documentation, carry out the conformity assessment, issue the EU declaration of conformity and affix the CE marking (Article 13(12)).

Annex I, Part I: security properties of the product

Point 1 sets the principle: design, develop and produce the product to ensure an appropriate level of cybersecurity based on the risks. Point 2 lists what the product must do, on the basis of your risk assessment and where applicable:

Requirement	Point	In practice
No known exploitable vulnerabilities when made available	2(a)	Scan code and dependencies before release; fix or mitigate what is exploitable
Secure by default configuration, with a reset to the original state	2(b)	No default passwords, unnecessary services off; tailor-made products for business users can agree otherwise
Vulnerabilities can be fixed through security updates	2(c)	Automatic security updates on by default where applicable, with a clear opt-out, update notifications and the option to postpone
Protection from unauthorised access	2(d)	Authentication, identity and access management, and reporting of possible unauthorised access
Confidentiality of data	2(e)	Encrypt relevant data at rest and in transit with state-of-the-art mechanisms
Integrity of data, commands, programs and configuration	2(f)	Signed updates and configuration, integrity checks, and reporting of corruption
Data minimisation	2(g)	Process only data that is adequate, relevant and limited to the intended purpose
Availability of essential functions, also after an incident	2(h)	Resilience and mitigation against denial-of-service attacks
Minimal impact on other devices and networks	2(i)	Rate limits, sane retry behaviour, no flooding of other services
Limited attack surface, including external interfaces	2(j)	Close unused ports and interfaces, remove debug access
Reduced impact of incidents through exploitation mitigation	2(k)	Sandboxing, memory protections, least privilege
Security logging and monitoring of internal activity	2(l)	Record access to and changes of data, services and functions, with an opt-out for the user
Secure, permanent deletion of data and settings, and secure transfer	2(m)	A factory reset that really erases data; secure export where data can be moved

"Where applicable" is not a free pass: your risk assessment must say whether each point applies and, if not, why (Article 13(3)). Market surveillance authorities can ask for it.

Annex I, Part II: vulnerability handling

For the whole support period, manufacturers must:

Requirement	Point
Identify and document vulnerabilities and components, including a software bill of materials (SBOM) in a commonly used, machine-readable format covering at least the top-level dependencies	1
Address and remediate vulnerabilities without delay, including through security updates, provided separately from functionality updates where technically feasible	2
Apply effective and regular security tests and reviews	3
Once an update is available, publicly disclose information about fixed vulnerabilities: description, affected products, impact, severity and remediation guidance (publication may be delayed in duly justified cases until users can patch)	4
Put in place and enforce a coordinated vulnerability disclosure policy	5
Facilitate sharing of information about vulnerabilities, including in third-party components, with a contact address for reporting them	6
Provide mechanisms to distribute updates securely, automatically where applicable for security updates	7
Disseminate security updates without delay and free of charge, with advisory messages for users (tailor-made products for business users can agree otherwise)	8

Annex II adds the information that must accompany the product, such as your contact details, the single point of contact for reporting vulnerabilities, where to find your disclosure policy, and the end date of the support period.

Which conformity assessment you need

Most products are in the default category and can use internal control (module A), a self-assessment. Products listed in Annex III (important) and Annex IV (critical) need more (Article 32):

Category	Examples	Conformity assessment
Default	Most software and connected products not listed in Annexes III and IV	Internal control (module A), or any stricter procedure
Important, class I (Annex III)	Identity and access management systems, browsers, password managers, anti-malware, VPNs, SIEM, operating systems, routers and switches, smart home security products, connected toys	Module A only if you fully apply harmonised standards, common specifications or a certification scheme at level substantial; otherwise EU-type examination (modules B and C) or full quality assurance (module H)
Important, class II (Annex III)	Hypervisors and container runtimes, firewalls, intrusion detection and prevention systems, tamper-resistant microprocessors and microcontrollers	Modules B and C, module H, or a European certification scheme at level substantial
Critical (Annex IV)	Hardware devices with security boxes, smart meter gateways, smartcards and secure elements	A European cybersecurity certificate at level at least substantial where the Commission requires one by delegated act (Article 8(1)); otherwise as for class II

The Annex III descriptions are summarised here; check the full wording, as several entries are limited to products with security-related functions.

Penalties

Not meeting the Annex I requirements or the obligations in Articles 13 and 14 can lead to fines of up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher (Article 64(2)). Breaches of a further list of obligations, for example on the CE marking, technical documentation and conformity assessment procedure, carry up to €10 million or 2% (Article 64(3)). National law sets the rest of the penalty rules.

A 12-month plan to December 2027

List your products with digital elements and classify each one: default, important class I or II, or critical.
Run and document a cybersecurity risk assessment per product, mapping every Annex I Part I point.
Generate an SBOM in your build pipeline and track vulnerabilities in your dependencies.
Publish a coordinated vulnerability disclosure policy and a contact address for reports.
Decide the support period for each product and how you will show its end date at purchase.
Separate security updates from feature releases where feasible, and make sure updates can be delivered securely.
Plan the conformity assessment: book a notified body early if you need modules B and C or H.
Prepare the technical documentation, the EU declaration of conformity and the user information in Annex II.

Selling to NIS2 or DORA firms? your customers already ask about secure development and vulnerability handling under NIS2 supply chain rules. CRA evidence answers many of the same questions. See also CRA vs NIS2.

Build the vulnerability process now. The Cybersecurity Starter Pack includes a patch and vulnerability management procedure, an asset inventory, a penetration test scoping document, an incident response plan and a 90-day security roadmap.

Sources

Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 8, 13, 32, 64, 69 and 71, Annexes I to IV, EUR-Lex