Your Practical Compliance Checklist
Article 14 reporting has applied since 11 September 2026 and the full Regulation applies from 11 December 2027, so work through every milestone now.
Phase 1: Assessment
- Determine Product Classification (Default, Class I, Class II)
- Conduct a cybersecurity risk assessment
- Identify all third-party and open-source dependencies
Phase 2: Technical Implementation
- Generate an automated SBOM (CycloneDX/SPDX)
- Ensure product is "Secure by Default" (no default passwords, closed ports)
- Implement a secure update mechanism
- Encrypt sensitive data at rest and in transit
Phase 3: Processes & Reporting
- Establish a Vulnerability Disclosure Policy (VDP)
- Publish a security.txt file
- Set up processes to meet the Article 14 deadlines (24h / 72h / final report) via the single reporting platform
- Complete the conformity assessment, technical documentation, EU Declaration of Conformity and CE marking
Generate your security.txt for free today to cross the first item off your list!
Get the CRA deadline calendar
A one-page PDF showing every CRA date that matters for your product team. Free — no spam, unsubscribe anytime.
Related articles
Ready to Take Action?
Start your CRA compliance journey with our free assessment tool.