CRA for manufacturers — product responsibility and lifecycle
Manufacturers need a reasoned product scope, security process and retained evidence across releases and the support period.
Before and after market placement
Connect risk assessment, applicable requirements, verification, documentation and conformity route to the supplied product. Maintain vulnerability handling and updates during the relevant lifecycle rather than treating CE preparation as the end of the work.
Reporting responsibility
Establish intake, awareness capture, triage, coordinating CSIRT selection and AR stage ownership. Record submitted references and evidence, monitor validation and prepare remediation or resubmission when needed.
Evidence you can explain
Retain why a decision was made, by whom and for which product/version. Supplier documents, scanner findings and templates are inputs for review, not automatic confirmation of compliance.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.