CRA cybersecurity requirements and evidence
Annex I combines product cybersecurity requirements with vulnerability-handling requirements. Implementation must reflect the product's risk assessment and lifecycle.
Product security
Assess risks and justify security measures for the intended product. Address secure defaults, access controls, data protection and reduction of attack surfaces where applicable. A ticked checklist is not proof that a measure works.
Vulnerability handling
Identify and document components and vulnerabilities, maintain appropriate SBOM records, provide a disclosure channel, assess findings and prepare secure fixes and update delivery.
Evidence structure
For each applicable requirement, retain the decision owner, rationale, implementation and verification evidence. Map evidence to releases and support periods. Distinguish not applicable, missing evidence and verified implementation instead of collapsing them into a compliant label.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.